topic Running an eval after a sub-search make my comparison negative in Splunk Search

Running an eval after a sub-search make my comparison negative

mybestfriendbob — Wed, 07 Jul 2021 13:12:18 GMT

I am trying to make a comparison of one field against itself but from a previous day. The use case is I'm trying to see if that value changes from day to day, the field is a file hash. I sun a search for today and rename the field I want to compare then run a subsearch and rename the field again so I can then compare them after the subsearch finishes but the eval always evaluates to false and displays the last response you place in the eval line.

My code:

index=my_index RuleName="Monitor The File" FileName="file.exe" earliest="06/11/2021:00:00:00" latest="06/11/2021:24:00:00"
| rename FileHash as "todays_hash"
| append [ search index=my_index RuleName="Monitor The File" FileName="file.exe" earliest="06/12/2021:00:00:00" latest="06/12/2021:24:00:00"
| rename FileHash as "yesterdays_hash"]
| eval description=case(todays_hash=yesterdays_hash,"Hash has not changed", todays_hash!=yesterdays_hash,"Hash has changed")
| table description todays_hash yesterdays_hash

I have tried changing the order of the eval putting != before == and it will always take the second options. The table it showing the eval results and the 2 hashes.

Thanks!

Re: Running an eval after a sub-search make my comparison negative

richgalloway — Wed, 07 Jul 2021 14:20:44 GMT

The append command creates separate events for the results of the subsearch. IOW, the first set of events will contain a todays_hash field, but not a yesterdays_hash" field and the appended events will contain a yesterdays_hash field, but not a todays_hash field. The solution is to use the stats command to combine the events on a common field.

index=my_index RuleName="Monitor The File" FileName="file.exe" earliest="06/11/2021:00:00:00" latest="06/11/2021:24:00:00" | rename FileHash as "yesterdays_hash" | append [ search index=my_index RuleName="Monitor The File" FileName="file.exe" earliest="06/12/2021:00:00:00" latest="06/12/2021:24:00:00" | rename FileHash as "todays_hash"] | stats values(*) as * by FileName | eval description=case(todays_hash=yesterdays_hash,"Hash has not changed", todays_hash!=yesterdays_hash,"Hash has changed") | table FileName description todays_hash yesterdays_hash

Re: Running an eval after a sub-search make my comparison negative

kamlesh_vaghela — Wed, 07 Jul 2021 16:48:22 GMT

@mybestfriendbob

You can try this also.

index=my_index RuleName="Monitor The File" FileName="file.exe" earliest=-1d@d | eval FileHash = if( _time>=relative_time(now(), "@d"),FileHash,null()) | eval PrevFileHash = if( _time<relative_time(now(), "@d"),FileHash,null()) | stats values(*) as * by FileName | eval description=case(FileHash=PrevFileHash,"Hash has not changed", FileHash!=PrevFileHash,"Hash has changed") | table FileName description FileHash PrevFileHash

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Running an eval after a sub-search make my comparison negative

mybestfriendbob — Thu, 08 Jul 2021 13:31:49 GMT

That worked perfectly, thanks!