https://community.splunk.com/t5/Splunk-Search/list-events-with-field-changed-by-other-field/m-p/467990#M131759 <P>Since you already have the correct results with <CODE>streamstats</CODE>, you should be able to use <CODE>table</CODE> to display the desired fields.</P> Thu, 06 Feb 2020 14:26:53 GMT richgalloway 2020-02-06T14:26:53Z https://community.splunk.com/t5/Splunk-Search/list-events-with-field-changed-by-other-field/m-p/467989#M131758 <P>Hi, I have an index with events such as:<BR /> CITY , TICKET, CREATION_DATE, OTHER METADATA FIELDS<BR /> Paris , 0001, 01 jan 2020, .......<BR /> Rome, 0002, 03 jan 2020, .......<BR /> Paris, 0003, 05 jan 2020, .......<BR /> Berlin, 0004, 08 jan 2020, .......<BR /> Berlin, 0006, 09 jan 2020, .......<BR /> Paris, 0003, 05 jan 2020, .......<BR /> Rome, 0002, 03 jan 2020, .......<BR /> Rome, 0009 , 10 jan 2020, .......<BR /> Paris, 0007, 07 jan 2020, .......<BR /> Berlin, 0006 , 09 jan 2020, .......</P> <P>I'd like to see which CITIES have more than 2 <EM>different</EM> tickets within 14 days; so i'd like to get all the events, with all its metadata, ordered by CITY, with <EM>different</EM> TICKET from the previous one (the previous in CREATION_DATE) , with the additional info about the difference in days from the previous ticket (DAYS_DIFF); with these added conditions:<BR /> only if DAYS_DIFF is &lt; 14 AND the number of different TICKET, grouped by CITY, is &gt; 2.<BR /> The first event by city has to be listed as well, with a "-" in the DAYS_DIFF field.<BR /> So in my case: only Paris has 3 different TICKET, each with DAYS_DIFF &lt;14. ok!<BR /><BR /> Berlin and Rome have only 2 different TICKET . Not listed! <BR /> Desiderata result:<BR /> CITY, TICKET, CREATION_DATE , DAYS_DIFF , OTHER METADATA FIELDS<BR /> Paris, 0001, 01 jan 2020 , - , .....<BR /> Paris, 0003, 05 jan 2020 , 5 , ....<BR /> Paris , 0007, 07 jan 2020 , 2 , ....<BR /> How can I achieve this result? <BR /> I've tried with streamstats: I have the correct results, but listed by rows with n-ples CITY, OLD_EVENT, NEW_EVENT ,DAYS_DIFF ; I'd like to have the above visualization instead.<BR /> Thanks in advance.</P> Wed, 30 Sep 2020 04:07:51 GMT https://community.splunk.com/t5/Splunk-Search/list-events-with-field-changed-by-other-field/m-p/467989#M131758 margie68 2020-09-30T04:07:51Z https://community.splunk.com/t5/Splunk-Search/list-events-with-field-changed-by-other-field/m-p/467990#M131759 <P>Since you already have the correct results with <CODE>streamstats</CODE>, you should be able to use <CODE>table</CODE> to display the desired fields.</P> Thu, 06 Feb 2020 14:26:53 GMT https://community.splunk.com/t5/Splunk-Search/list-events-with-field-changed-by-other-field/m-p/467990#M131759 richgalloway 2020-02-06T14:26:53Z