topic Re: Log filtering based on field value change. in Splunk Search

Log filtering based on field value change.

rakes568 — Wed, 03 May 2017 12:56:09 GMT

I have two kinds of logs

sourcetype = abc IP = a.b.c.d status=active
sourcetype = abc IP = a.b.c.e status=active
sourcetype = abc IP = a.b.c.f status=active
sourcetype = abc IP = x.x.x.x status=inactive
sourcetype = abc IP = a.b.c.d status=inactive

I want to get a list of IP with status=active, but IP with whose status has changed to inactive should get filtered out.

Like in the example output should be:
a.b.c.e
a.b.c.f

Re: Log filtering based on field value change.

richgalloway — Wed, 03 May 2017 13:04:59 GMT

Try this.

 sourcetype = abc | dedup IP | where status="active"

Re: Log filtering based on field value change.

niketn — Wed, 03 May 2017 13:20:46 GMT

You can try the following:

<YourBaseSearch> sourcetype="abc" IP=* status="active" OR status="inactive"
| stats dc(status) as StatusCount values(status) as status by IP
| search status="active" AND status!="inactive"

Re: Log filtering based on field value change.

gcusello — Wed, 03 May 2017 13:28:03 GMT

Hi rakes568
try something like this:
sourcetype = abc (status=active OR status=inactive)
| transaction IP
| search NOT status=inactive
| table IP

Bye.
Giuseppe