SPL query help

KulvinderSingh — Wed, 19 Jun 2024 11:12:55 GMT

Hi All,

Need some help with SPL query to compare the data from same host on 2 different dates and give me a status as "found" or "not found" . Status = Found if it finds the notepad is still installed on same Path on the same machine else not found.

so far I have created a kvstore lookup to store the data but cannot come up with logic to compare the data

I have added sample data below. All help is appreciated.

HostNameExeVersion Path ProductName RunDate sourcetype
xxxxx null C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.3996_none_e397b63725671b86\f\notepad.exe null 2024-06-13 07:41:37 feed
xxxxx null C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.3996_none_e397b63725671b86\r\notepad.exe null 2024-06-14 07:41:37 feed

Re: SPL query help

ITWhisperer — Wed, 19 Jun 2024 11:44:15 GMT

Assuming you have a way to uniquely identify your events, you could try something like this:

Read current data
Set a field to 1
Append previous data (setting field to 2)
Sum the field by unique id

Where sum is 3, the id exists in both data sets; where it is 2, it exists previous data set, where is 1 it only exists in current data set.

topic SPL query help in Splunk Search

SPL query help

Re: SPL query help