https://community.splunk.com/t5/Splunk-Search/Help-with-events-data/m-p/365210#M169942 <P>It works as i was hoping, thanks for your help!!!</P> Fri, 27 Apr 2018 10:28:16 GMT ppatrikfr 2018-04-27T10:28:16Z https://community.splunk.com/t5/Splunk-Search/Help-with-events-data/m-p/365207#M169939 <P>I have this code bellow and i want to just keep with lines of when my Virtual Machine changed Cluster ou VMhost.</P> <P>Obs.: I cant use "dedup" because i have VMs that was moved to the same cluster twice.![alt text][1] </P> <P>earliest=03/01/2018:00:00:00 latest=03/31/2018:23:59:00 sourcetype="VCENTER_VMS_INFO" <BR /> | eval VM=upper(VM) <BR /> | table _time VM VMhost Cluster <BR /> | where VM="VMName" | bucket span=1h _time | stats values(VMhost) as VMhost values(Cluster) as Cluster by _time VM | </P> Tue, 29 Sep 2020 19:16:27 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-events-data/m-p/365207#M169939 ppatrikfr 2020-09-29T19:16:27Z https://community.splunk.com/t5/Splunk-Search/Help-with-events-data/m-p/365208#M169940 <P>Give this a try</P> <PRE><CODE>earliest=03/01/2018:00:00:00 latest=03/31/2018:23:59:00 sourcetype="VCENTER_VMS_INFO" | eval VM=upper(VM) | table _time VM VMhost Cluster | where VM="DCDEV00027" | bucket span=1h _time | stats values(VMhost) as VMhost values(Cluster) as Cluster by _time VM | streamstats current=f window=1 values(VMhost) as prevVMhost values(Cluster) as prevCluster by VM | whehre VMhost!=prevVMhost OR Cluster!=prevCluster </CODE></PRE> Thu, 26 Apr 2018 18:49:52 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-events-data/m-p/365208#M169940 somesoni2 2018-04-26T18:49:52Z https://community.splunk.com/t5/Splunk-Search/Help-with-events-data/m-p/365209#M169941 <P>You can use autoregress to get the value from previous row and compare it with current row value. Something like below</P> <PRE> | autoregress VMhost as Old_VMhost | eval Flag=if(VMhost==Old_VMhost ,"N","Y") | where Flag="Y" </PRE> Thu, 26 Apr 2018 18:49:54 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-events-data/m-p/365209#M169941 pradeepkumarg 2018-04-26T18:49:54Z https://community.splunk.com/t5/Splunk-Search/Help-with-events-data/m-p/365210#M169942 <P>It works as i was hoping, thanks for your help!!!</P> Fri, 27 Apr 2018 10:28:16 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-events-data/m-p/365210#M169942 ppatrikfr 2018-04-27T10:28:16Z