topic Compare results from same field in Splunk Search

Compare results from same field

CyberWolf — Wed, 23 Oct 2024 12:14:47 GMT

I'm using cmd |iplocation src, and the results produce results for the City. Next i want to compare each City and report when results is different.

Example when result for a City is Miami and next hour or so in the same field for the City is Boston.

ITWhisperer — Wed, 23 Oct 2024 13:09:45 GMT

| streamstats latest(city) as previous current=f

gcusello — Wed, 23 Oct 2024 13:17:11 GMT

I suppose that you want to check this for each Account_name, you could try with stats:

<your_search> | iplocation src | stats dc(city) AS city_count BY Account_name | where city_count>1

use the Account_name field you have in your logs.

Ciao.

Giuseppe

CyberWolf — Wed, 23 Oct 2024 13:28:06 GMT

It worked! thank you!

richgalloway — Wed, 23 Oct 2024 17:24:37 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

CyberWolf — Thu, 24 Oct 2024 12:08:28 GMT

Thanks Everyone for fast response!