https://community.splunk.com/t5/Splunk-Search/Identify-a-sequence-of-events-on-the-consecutive-change-of-value/m-p/625449#M217406 <P>Try something like this</P><LI-CODE lang="markup">| streamstats window=3 list(event) as last3events | eval last3events=mvjoin(last3events,",") | where last3events == "Open,Get,Read"</LI-CODE><P>Depending on the order of events for your initial search, you may either need to sort them, or look for "Read,Get,Open"</P> Thu, 29 Dec 2022 07:28:56 GMT ITWhisperer 2022-12-29T07:28:56Z https://community.splunk.com/t5/Splunk-Search/Identify-a-sequence-of-events-on-the-consecutive-change-of-value/m-p/625430#M217404 <P>Hi</P><P><BR />We index the accesses made on a filer. For each action on a file, events are generated and indexed in Splunk.</P><P><BR />The copy of a file does not directly generate a "copy" event but the "Event.System.EventName" field consecutively takes the three values "Open Object", "Get Object Attributes", "Read Object".</P><P>This corresponds to three events in Splunk with no real common fields. How to build a query that would identify this consecutive sequence of events to alert us of a file copy ?</P><P>Maybe the streamstat command could be used but I can't figure out how.</P> Wed, 28 Dec 2022 16:46:34 GMT https://community.splunk.com/t5/Splunk-Search/Identify-a-sequence-of-events-on-the-consecutive-change-of-value/m-p/625430#M217404 vburgun 2022-12-28T16:46:34Z https://community.splunk.com/t5/Splunk-Search/Identify-a-sequence-of-events-on-the-consecutive-change-of-value/m-p/625449#M217406 <P>Try something like this</P><LI-CODE lang="markup">| streamstats window=3 list(event) as last3events | eval last3events=mvjoin(last3events,",") | where last3events == "Open,Get,Read"</LI-CODE><P>Depending on the order of events for your initial search, you may either need to sort them, or look for "Read,Get,Open"</P> Thu, 29 Dec 2022 07:28:56 GMT https://community.splunk.com/t5/Splunk-Search/Identify-a-sequence-of-events-on-the-consecutive-change-of-value/m-p/625449#M217406 ITWhisperer 2022-12-29T07:28:56Z https://community.splunk.com/t5/Splunk-Search/Identify-a-sequence-of-events-on-the-consecutive-change-of-value/m-p/625470#M217420 <P>Hi,</P><P>Thanks for your help ! It's perfect !</P><P>It works for me</P> Thu, 29 Dec 2022 12:51:24 GMT https://community.splunk.com/t5/Splunk-Search/Identify-a-sequence-of-events-on-the-consecutive-change-of-value/m-p/625470#M217420 vburgun 2022-12-29T12:51:24Z