https://community.splunk.com/t5/Splunk-Search/How-to-compare-when-a-field-value-changes-from-current-to/m-p/491875#M137272 <P>Wow that is awesome!!! Thanks</P> Wed, 06 May 2020 20:30:45 GMT Glasses 2020-05-06T20:30:45Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-when-a-field-value-changes-from-current-to/m-p/491873#M137270 <P>I am looking to find events where IP address changes from previous to current, however using fist(ip) and last(ip) misses the events in between the first and last... </P> <P>Ideally I am looking to find when a change occurs for the IP value and then look at the previous IP value... this comparison is then used to find ip geoloc and calc the speed = dist/time with haversine app.</P> <P>Thank you</P> Wed, 06 May 2020 18:45:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-when-a-field-value-changes-from-current-to/m-p/491873#M137270 Glasses 2020-05-06T18:45:59Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-when-a-field-value-changes-from-current-to/m-p/491874#M137271 <P>Look at the <CODE>streamstats</CODE> command for this. Any tracking of change over time, <CODE>streamstats</CODE> is your go-to verb. </P> <P>We'll assume there is a key called <CODE>user</CODE>. </P> <PRE><CODE>your search that gets the records you want, with at least these fields | fields _time user someIP | sort 0 _time | streamstats current=f last(someIP) as priorIP last(_time) as priorTime by user | where NOT (someIP=priorIP) ... the remainder of your search. </CODE></PRE> Wed, 06 May 2020 19:19:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-when-a-field-value-changes-from-current-to/m-p/491874#M137271 DalJeanis 2020-05-06T19:19:36Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-when-a-field-value-changes-from-current-to/m-p/491875#M137272 <P>Wow that is awesome!!! Thanks</P> Wed, 06 May 2020 20:30:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-when-a-field-value-changes-from-current-to/m-p/491875#M137272 Glasses 2020-05-06T20:30:45Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-when-a-field-value-changes-from-current-to/m-p/491876#M137273 <P>You are quite welcome. <CODE>streamstats</CODE> processes the records in order, remembering only the records it has already seen, so you must sort the records in the order you want before you apply the command. </P> Wed, 06 May 2020 20:44:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-when-a-field-value-changes-from-current-to/m-p/491876#M137273 DalJeanis 2020-05-06T20:44:39Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-when-a-field-value-changes-from-current-to/m-p/491877#M137274 <P>so that is the purpose of sort 0 &gt; return all results, thanks</P> Wed, 06 May 2020 20:48:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-when-a-field-value-changes-from-current-to/m-p/491877#M137274 Glasses 2020-05-06T20:48:01Z