topic Re: Field value changes for two environments in Splunk Search

How to find field value changes for two environments?

Fe-atSplunk — Wed, 09 Mar 2022 16:38:22 GMT

There are two environments, INT and PROD. The value of IREFFECTIVEDATE in INT is always the same, as is PROD, however they have different values. I want to know when the value of IREFFECTIVEDATE in its environment changes. Here is a log sample:

2022-03-04 14:13:00.006, IREFFECTIVEDATE="2016-07-01 00:00:00.0", IRLOANRATE="5"

So far my search is this:

Streamstats recognizes the changing value but it needs to be split by env.

Any ideas please?

Re: Field value changes for two environments

ITWhisperer — Wed, 09 Mar 2022 08:54:16 GMT

Try this

| streamstats current=f global=f last(IREFFECTIVEDATE) as priorDate last(_time) as priorTime by env

Re: Field value changes for two environments

Fe-atSplunk — Wed, 09 Mar 2022 15:20:28 GMT

Hi,

Thanks for your response but it doesn't do anything. The previous event is PROD and the next one is INT, it still creates an incident event though the value of INT is what it always is.

Re: Field value changes for two environments

somesoni2 — Wed, 09 Mar 2022 15:47:25 GMT

Your search is selecting just one event (as it uses "| head 1"). How are you comparing two IREFFECTIVEDATE values?

Re: Field value changes for two environments

ITWhisperer — Wed, 09 Mar 2022 15:57:56 GMT

Here is a runanywhere example showing it working

Obviously, if it isn't working for you, something else is amiss!

Re: Field value changes for two environments

Fe-atSplunk — Wed, 09 Mar 2022 16:01:20 GMT

For better visibility I'm showing in Statistics what was sent last (as we get those alerts once an hour). Looking back further I get lost of Events.

As seen here there are two events per hour, one PROD, one INT but nothing changes from the last entry

Re: Field value changes for two environments

somesoni2 — Wed, 09 Mar 2022 16:04:01 GMT

What's the time range you use in your alert? Last two hours?

Re: Field value changes for two environments

Fe-atSplunk — Wed, 09 Mar 2022 16:09:37 GMT

That's a good point, the alerts is looking back at the last one hour so it doesn't have anything to compare to. I'll try it with 2 hours. The problem is it takes 2 hours to wait for results

Re: Field value changes for two environments

somesoni2 — Wed, 09 Mar 2022 16:15:05 GMT

Based on samples, you're receiving events around 13th minute of every hour so you can setup your alert to run shortly after that (e.g. run on 15th minute) with time-range of last 120 minute so that you'll cover data for this hour and last hour and get your alert sooner.

Re: Field value changes for two environments

Fe-atSplunk — Mon, 14 Mar 2022 09:48:57 GMT

Sorry that still doesn't work. At the moment the last two logs are both Prod and Stats show one event so it would still trigger an alert even though the value hasn't changed. Any ideas?