topic Re: change events only in Splunk Search

How to get change events only?

eranhauser — Mon, 02 Oct 2023 17:30:46 GMT

I have events with the following keys: key1, key2 & key3.

I would like to get the change events i.e. events that their key1, key2 & key3 values are not in the events of previous day.

What should the query look like?

Re: change events only

bowesmana — Wed, 27 Sep 2023 22:05:35 GMT

What data is the correlation between the same event - please give an example of the data you may see and what you would expect.

For example, if you have an event yesterday with

key1=A, key2=B,key3=C

and an event today with

key1=A, key2=B,key3=D

what do you want to show? If you have lots of events with different fields, is there some common object that connects those events to today's events?

Re: change events only

eranhauser — Wed, 27 Sep 2023 22:50:48 GMT

a change event is considered if any combination of key1, key2 & key3 is new. In your example key1=A, key2=B,key3=D will be considered as a new event.

Re: change events only

bowesmana — Wed, 27 Sep 2023 22:58:49 GMT

then something like

index=your_index earliest=-1d@d latest=now() ``` Collect all combinations of key 1, 2 and 3 by day ``` | bin _time span=1d | stats count by _time key1 key2 key3 ``` Count the number of days these key combinations occur ``` | stats dc(_time) as times list(_time) as days by key1 key2 key3 ``` and then if there is only 1 variant and it is today, it's a new type ``` | where times=1 AND days=relative_time(now(), "@d")

Re: change events only

eranhauser — Thu, 28 Sep 2023 01:25:48 GMT

There should be something similar to SQL in splunk like right outer joint no?

Re: change events only

bowesmana — Fri, 29 Sep 2023 00:19:43 GMT

There is a join command, but it is NOT the first, second or third choice for a Splunk solution - you can and should always use stats to join data. join has limitations, requires a second search to do the join data.

This stats command is effectively calculating all the similar triplets by time and where there are two times (e.g. 2 days) you have a non-change event, so discard it.