Splunk Search

Query to Display change in values of fields

muralianup
Communicator

I trying to write a query to check the changes in versions of a software. When using timechart (stacked) I can see multiple columns (when there was change in the version of software) and I am trying to display only those days which had occurrence of multiple columns in the graph. Any suggestions ?alt text

0 Karma
1 Solution

muralianup
Communicator

The streamstats command helped. Borrowed the concept from one of the Splunk blog entries (on tracking DHCP lease for a particular MAC id).

| streamstats current=false last(Version) as new_Version last(_time) AS time_of_change BY src_ip | where Version!=new_Version | convert ctime(time_of_change) AS time_of_change | rename Version as old_Version | stats count by date_wday

View solution in original post

muralianup
Communicator

The streamstats command helped. Borrowed the concept from one of the Splunk blog entries (on tracking DHCP lease for a particular MAC id).

| streamstats current=false last(Version) as new_Version last(_time) AS time_of_change BY src_ip | where Version!=new_Version | convert ctime(time_of_change) AS time_of_change | rename Version as old_Version | stats count by date_wday

niketn
Legend

@muralianup, please accept your Answer to mark the question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Can you share your query? Without knowing that, my suggestion would be to add following to your existing search.

your current search producing above output
| eval versions=0
| foreach * [eval versions=if('<<FIELD>>' > 0,versions+1,versions)]
| where versions>1 | fields -versions

muralianup
Communicator

Base query is index=web_prxy domain=abc useragent= | rex filed=useragent "(?P[\d]*)" | timechart count by Version limit=5

Does stereamstats helps ?

0 Karma

niketn
Legend

Just extending @somesoni2 's Answer to your scenario.

<YourBaseSearch>
| rename * as Count*
| rename Count_time as _time
| rename Count_span as _span
| eval versions=0
| foreach Count* [eval versions=if(<<FIELD>> > 0,versions+1,versions)]
| search versions>1
| fields - versions
| rename Count* as *
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...