topic Re: How to find changing serial numbers in Splunk Search

How to find changing serial numbers?

splunk_enjoyer — Fri, 02 Sep 2022 14:29:21 GMT

Hello Splunk Enjoyers! I have problem

Information about routers arrives every minute, so

What I have: name_of_router and serial_number of client on index = routers

What i want: i want to make alert, if serial_number has changed.

How should i do this?

splunk_enjoyer — Fri, 02 Sep 2022 10:06:52 GMT

for example:

| table name serial_number

result:

name | serial_number

cisco1 | ABC123456

cisco1 | cdf95959595

ITWhisperer — Fri, 02 Sep 2022 10:07:40 GMT

Can you share some depersonalised events in a code block </>

ITWhisperer — Fri, 02 Sep 2022 10:10:37 GMT

| stats dc(serial_number) as count by name | where count > 1

splunk_enjoyer — Fri, 02 Sep 2022 10:15:19 GMT

so how can i result events where serial number had changed, not count

splunk_enjoyer — Fri, 02 Sep 2022 10:20:46 GMT

@ITWhisperer thanks! its work!

and how can i result serial number and serial_number where serial_number >1? not count

ITWhisperer — Fri, 02 Sep 2022 11:09:34 GMT

If you want to keep the events, use eventstats

| eventstats dc(serial_number) as count by name | where count > 1