https://community.splunk.com/t5/Splunk-Search/Validate-changes-through-SPL/m-p/525272#M148206 <P>Because I am filtering with "abc". So technically package exist is rhetorical as it always gonna give 1&nbsp;</P> Mon, 19 Oct 2020 01:13:35 GMT k31453 2020-10-19T01:13:35Z https://community.splunk.com/t5/Splunk-Search/Validate-changes-through-SPL/m-p/525171#M148159 <P>Hi, We are going to deploy changes which will delete certain package from instance. We want to know whether this package is getting deleted after the changes goes through. We are capturing this data in Splunk.&nbsp;<BR /><BR />So Let's say we have package=abc We can find if package exist using following SPL:</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">index=osstats sourcetype=package "abc" | bin _time span=1d | multikv fields NAME | eval package_exist=if(like(NAME,"abc%"),1,0) | eval package_name=if(like(NAME,"abc%"),NAME,NULL) | stats count by _time host package_exist package_name</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>Following index is polling data hourly therefore if search for last 24 hours, it will report count=24, host=abc.com,package_exist=1, package_name=abc<BR /><BR />Now I have created lookup table from this for last 1 year worth of data.&nbsp;<BR /><BR />What i want to know is, suppose I have host (doesn't have to be part of above query), I want to check if it had package earlier and now it is getting removed.&nbsp;<BR /><BR />I am not sure how I can go above doing that.&nbsp;</P> Sat, 17 Oct 2020 03:26:46 GMT https://community.splunk.com/t5/Splunk-Search/Validate-changes-through-SPL/m-p/525171#M148159 k31453 2020-10-17T03:26:46Z https://community.splunk.com/t5/Splunk-Search/Validate-changes-through-SPL/m-p/525179#M148167 <P>Assuming your index has been populated every hour for the past year, your query appears to get the daily count of the number of hours each abc package existed on each host.&nbsp; The package doesn't have to exist on the host now. Why isn't what you already have sufficient?</P> Sat, 17 Oct 2020 08:51:53 GMT https://community.splunk.com/t5/Splunk-Search/Validate-changes-through-SPL/m-p/525179#M148167 ITWhisperer 2020-10-17T08:51:53Z https://community.splunk.com/t5/Splunk-Search/Validate-changes-through-SPL/m-p/525272#M148206 <P>Because I am filtering with "abc". So technically package exist is rhetorical as it always gonna give 1&nbsp;</P> Mon, 19 Oct 2020 01:13:35 GMT https://community.splunk.com/t5/Splunk-Search/Validate-changes-through-SPL/m-p/525272#M148206 k31453 2020-10-19T01:13:35Z