topic Re: timechart conditional result in Splunk Search

timechart conditional result

light_of_sirius — Thu, 05 Nov 2020 11:16:06 GMT

Hello,

i have objects with names that all carry a unique and constant "Software-Signature" with them.

This signature is supposed to never change. And i know that it is in its original state at some timestamp.

Now, i want to create a dashboard that displays the objects current signature, its original signature and if they are identical.

This works besides the fact that the field identical displays nothing.

Assuming, there is deviation and you find a 0, as in the two signatures are not identical. You may want to find when that occured, so i would like to make timechart of the identical-field by name.

Thank you in advance, and i hope i managed to describe the task clearly.

Re: timechart conditional result

renjith_nair — Thu, 05 Nov 2020 14:01:13 GMT

What about just getting the first and latest and compare them ?

index=my_index earliest=".." latest=".." | stats earliest(Signatur) as sig_orig,latest(Signatur) as sig_current by name |eval Identical = if(sig_org == sig_current,"Yes","No")

Re: timechart conditional result

light_of_sirius — Mon, 09 Nov 2020 08:10:48 GMT

Thx sorry for the late response.

The original signatures lay back quite some time, so i wanted to avoid having to do search such a large interval.

Additionally i would not really see the logic being applicable to a timechart.

Say i want to use the signatures of one day 2 years ago as my reference point and i want to compare if all the different objects had their original signature in the last week, binned daywise and by "object_name".

If you unterstand want i am trying to say.

Anyway my solution for now is

index=my_index name=* | stats latest(Signatur) as sig_c by name |appendcols [ search index=my_index earliest="11/4/2019:08:00:00" latest="11/4/2019:18:00:00" name=*| stats latest(Signatur) as sig_o by name ] | eval id = if(sig_o==sig_c, "iO", "niO")| table name id

And for the timechart

index=my_index name="001"| timechart span=1d latest(Signatur) as sig_c |appendcols [ search index=my_index earliest="11/4/2020:08:00:00" latest="11/4/2020:10:00:00" name="001"| stats latest(Signatur) as sig_o ] | filldown sig_o | eval id = if(sig_o==sig_c, 1, 0)| timechart span=1d values(id) as "iO/niO"

But this does not support the desired groub by name yet.