https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384230#M112219 <P>I have developed a search, with help years ago, that will show differences in a netstat command using "diff" and "head 2".</P> <PRE><CODE>index=foo host=bar sourcetype=netstat | head 2 | diff | search NOT "Results are the Same" </CODE></PRE> <P>The netstat runs every hour with a scripted input, and the search runs hourly to see if anything has changed. If it has, an alert fires.</P> <P>As you can see, the search specifies a host. However, what if I wanted to run this search across many hosts? Would I have to create a separate search for each host? Or is there some Splunk magic I can utilize?</P> <P>Thanks for your time!</P> Thu, 14 Jun 2018 15:56:53 GMT aferone 2018-06-14T15:56:53Z https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384230#M112219 <P>I have developed a search, with help years ago, that will show differences in a netstat command using "diff" and "head 2".</P> <PRE><CODE>index=foo host=bar sourcetype=netstat | head 2 | diff | search NOT "Results are the Same" </CODE></PRE> <P>The netstat runs every hour with a scripted input, and the search runs hourly to see if anything has changed. If it has, an alert fires.</P> <P>As you can see, the search specifies a host. However, what if I wanted to run this search across many hosts? Would I have to create a separate search for each host? Or is there some Splunk magic I can utilize?</P> <P>Thanks for your time!</P> Thu, 14 Jun 2018 15:56:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384230#M112219 aferone 2018-06-14T15:56:53Z https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384231#M112220 <P>Can you not do dedup host?<BR /> <PRE><BR /> index=foo host=* sourcetype=netstat <BR /> | dedup 2 host<BR /> </PRE></P> Thu, 14 Jun 2018 16:48:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384231#M112220 pradeepkumarg 2018-06-14T16:48:04Z https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384232#M112221 <P>Can you explain this a little further on what this would be doing? Thanks!</P> Thu, 14 Jun 2018 18:52:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384232#M112221 aferone 2018-06-14T18:52:55Z https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384233#M112222 <P>so | head 2 will give you the latest 2 entries for the host you specified.</P> <P>by making host=* and adding | dedup 2 host, you are retaining the latest 2 entries for every host</P> Thu, 14 Jun 2018 19:56:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384233#M112222 pradeepkumarg 2018-06-14T19:56:55Z https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384234#M112223 <P>The diff command can only compare 2 result/row, so having multiple host entries would not work. If you don't need "diff command type output" and just looking to alert when current netstat output of a host is different then previous entry, you can do something like this.</P> <PRE><CODE>index=foo sourcetype=netstat | table host _raw | dedup 2 host | streamstats count as sno by host | chart values(_raw) over host by sno | where '1'!='2' </CODE></PRE> <P>The dedup command will just list two entries for a host, most recent and 2nd recent. The streamstats command just give a serial number to them which'll be 1 and 2 since there will be only two entries after dedup. The chart command will give a output with field host, 1 (which will have most recent event's raw data) and 2 (which will have 2nd recent event's raw data). The where clause just compare both.</P> Thu, 14 Jun 2018 20:50:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384234#M112223 somesoni2 2018-06-14T20:50:41Z https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384235#M112224 <P>Sorry for the delay, and thank you for posting! . I will be trying this soon. Thanks again!</P> Thu, 21 Jun 2018 19:14:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384235#M112224 aferone 2018-06-21T19:14:18Z https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384236#M112225 <P>This looks very promising. I am pushing our netstat config to more boxes to test this. Where does "sno" come into play in the search? Thanks again!!</P> Thu, 21 Jun 2018 19:17:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384236#M112225 aferone 2018-06-21T19:17:19Z https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384237#M112226 <P>The search is definitely working, and thank you!</P> <P>But for some reason, when I set it up as an alert, I can't get it to send an email? I am setting it to "events greater to zero", just like every other alert we've configured. </P> <P>Am I missing something?</P> <P>Thanks!</P> Mon, 25 Jun 2018 14:02:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-run-a-diff-search-with-a-Head-2-command-across-multiple/m-p/384237#M112226 aferone 2018-06-25T14:02:50Z