topic Re: Reporting on Duplicates in Getting Data In

Reporting on Duplicates

mphillips_18 — Mon, 28 Sep 2020 16:27:59 GMT

Hello,

So every 24 hours we run daily evaluations on computers that create numerical ratings. Our daily reports display Time(of scan), ComputerID, rating value. After 24 hours, all nodes are scanned again. Some will (hopefully) have a lower numerical rating value. We would like to run a separate report showing the change in value of the numerical rating for each compuert that actually changed over the 24 hour period.

ComputerID=5 character alpha numeric
Rating value=0-100

The following query works for single instances of evaluation.
index=main sourcetype=scan host=scanner ComputerID==1234R | stats range(numerical_rating) AS "Daily Change",values AS Computers | table Computers,"Daily Changes"

Unfortunately we can not get this to evaluate properly against 200 computerIDs at one time. Is there a way to separate out the duplicate computerIDs with associated unique numerical_ratings and then get the difference of the numerical_rating reported with the associated computerID?
DOH!

Thanks!

Re: Reporting on Duplicates

martin_mueller — Thu, 24 Apr 2014 20:04:55 GMT

Does this generate a data set matching your events?

| gentimes start=-10 | eval _time = endtime | fields _time | eval ComputerID = "id1 id2 id3" | makemv ComputerID | mvexpand ComputerID | eval Rating = random()%101

Re: Reporting on Duplicates

martin_mueller — Thu, 24 Apr 2014 20:11:10 GMT

Based on above generated data, you can do this:

index=main sourcetype=scan host=scanner | sort + _time
| streamstats window=1 global=f current=f last(Rating) as last_rating by ComputerID
| eval "Rating Change" = Rating - last_rating | table _time ComputerID Rating "Rating Change"

Re: Reporting on Duplicates

mphillips_18 — Thu, 24 Apr 2014 20:24:08 GMT

Thanks...the query returns data except for the "Rating Change" value. None of the duplicate computerIDs display a value for Rating - last_rating

Re: Reporting on Duplicates

martin_mueller — Thu, 24 Apr 2014 20:25:51 GMT

Make sure your field names match. For example, you've said ComputerID in the question but computerID in this comment.

Re: Reporting on Duplicates

mphillips_18 — Thu, 24 Apr 2014 20:34:58 GMT

BINGO! I missed one of the fields.

Thank you