topic Re: last status changed time in Splunk Search

last status changed time

roopeshetty — Tue, 30 Mar 2021 07:57:11 GMT

Hi Guys,

I have this query , which will provide me the list of “Name” on which ProtectionStatus is OFF.

ProtectionStatus goes OFF and ON frequently ( we run the query in every 6 hours). Here we need to add one more field or column which should show us the time (Date and time) when the last ProtectionStatus change happened (it can be either OFF to ON or ON to OFF). Can some one please help us on this.

Re: last status changed time

rnowitzki — Tue, 30 Mar 2021 09:18:09 GMT

Hi @roopeshetty ,

This should give you a start:

| streamstats current=f window=1 last(ProtectionStatus) as prev_status | eval statuschange=if(ProtectionStatus!=prev_status,"true", "false")

There was a similiar question recently. There is also another option using command "Delta" suggested by @manjunathmeti

Cheers
Ralph

Re: last status changed time

roopeshetty — Tue, 30 Mar 2021 09:46:01 GMT

Hi Ralph,

I added the your query at the end of my query (as pasted below) and ran it. It gave me a new field "statuschange" which has value as "false". But actually I want to see the date and time when the last ProtectionStatus change happened (it can be either OFF to ON or ON to OFF).

index=altiris sourcetype=altiris source=altiris_BGP_Excluded_WithREGION OR source=mi_input://altiris_BGP_Excluded_WithREGION | eval ProtectionStatus = if(Protectionstatus == 0, "OFF", "ON") | dedup Name | where ProtectionStatus="OFF" | streamstats current=f window=1 last(ProtectionStatus) as prev_status
| eval statuschange=if(ProtectionStatus!=prev_status,"true", "false")

Re: last status changed time

rnowitzki — Tue, 30 Mar 2021 09:57:08 GMT

You filtered on "OFF" events before the streamstats, so you don't have any status changes any more after your query...

I removed your where command:

index=altiris sourcetype=altiris source=altiris_BGP_Excluded_WithREGION OR source=mi_input://altiris_BGP_Excluded_WithREGION | eval ProtectionStatus = if(Protectionstatus == 0, "OFF", "ON") | dedup Name | streamstats current=f window=1 last(ProtectionStatus) as prev_status | eval statuschange=if(ProtectionStatus!=prev_status,"true", "false")

You could now add a filter for statuschange=true, so you only see the events where a change of status happened.

| where statuschange="true"

Re: last status changed time

roopeshetty — Tue, 30 Mar 2021 12:27:43 GMT

thanks Ralph. I got the output now. I really appreciate your help on this.