How can i concatenate fields in my data then compare?

[mauricio_sandov]

I am trying to find problems created by imaged systems running Alertus software.

Scenario:
Client checks into Alertus and logs its hostname while application assigns it a deviceID. Techs deploy Image that had Alertus previously installed. Newly imaged systems checkin and Alertus Application thinks its same device so it adds system with same deviceID but with different hostname. Causing repeated check-ins with new hostname and IP change.

I want to be able to find and alert on the following

Ignore event
Event1: field1=0077C1, field2=frontofficePC
Event2: field1=0077C1, field2=frontofficePC

Alert on this (0077C1 belongs to frontofficePC)
Event3: field1=0077C1, field2=backofficePC

sample log
2017-05-15 11:54:34.046 [INFO] 0077C1 (51504) [backofficePC\user1] - Auto-update flagged: Reason = IP address changed from 10.13.8.15, 172.24.139.192 to 172.24.139.192

Please and thank you for any help or direction.

[richgalloway · Accepted solution]

This should return results when field1 has more than one field2 value.

<your base search> | stats count(field2) as field2count by field1 | search field2count > 1

[mauricio_sandov]

Perfect, this gave me what I was looking for. And you gave me more ideas. I can also count field1 and changed IP entries over period of time which would indicate problem as well. thank you so much.

[richgalloway]

Do you only have field1 and field2 to work with? I would search for "IP address changed" and alert if it's found.

[mauricio_sandov]

Yes I have more fields. Cant alert on changed IP as it is normal behavior for IP address change since clients are using DHCP.