topic Re: Comparing results to identify values that have a certain value in previous records in Splunk Search

Comparing results to identify values that have a certain value in previous records

Blueochotona — Fri, 28 Mar 2025 12:24:19 GMT

The two raw results are as follows :

(1)

EventType="Device" Event="InstallProfileConfirmed" User="sysadmin" EnrollmentUser="hasubram" DeviceFriendlyName="blabla MacBook Air macOS 15.3.2 Q6LW" EventSource="Device" EventModule="Devices" EventCategory="Command" EventData="Profile=Apple macOS Apple Intelligence Restrictions" Event Timestamp: Mar 28 09:29:40

(2)

EventType="Device" Event="DeviceOperatingSystemChanged" User="sysadmin" EnrollmentUser="hasubram" DeviceFriendlyName="blabla MacBook Air macOS 15.3.2 Q6LW" EventSource="Device" EventModule="Devices" EventCategory="Assignment" EventData="Device=75639" Event Timestamp: Mar 28 09:29:29

Hoping to combine a search to identify (1)‘s DeviceFriendlyName="blabla MacBook Air macOS 15.3.2 Q6LW" which is a shared key between two results , as long (2) happens before (1) from a chronological experience.

I am already using the following to try and exclude certain results too :

Index=*** <<Search Parameters>> NOT DeviceFriendlyName IN (*15.3.0*,*15.3.1*)

Thank you 🙂

Re: Comparing results to identify values that have a certain value in previous records

livehybrid — Fri, 28 Mar 2025 13:20:24 GMT

Hi @Blueochotona

Have a look at the following, does this achieve what you're looking for?

index=*** <<Search Parameters>> NOT DeviceFriendlyName IN (*15.3.0*,*15.3.1*) ( (EventType="Device" Event="DeviceOperatingSystemChanged") OR (EventType="Device" Event="InstallProfileConfirmed") ) | eval {Event}_time=_time | stats latest(*_time) as *_time values(Event) as events by DeviceFriendlyName | where MATCH(events, "DeviceOperatingSystemChanged") AND MATCH(events, "InstallProfileConfirmed") AND DeviceOperatingSystemChanged_time < InstallProfileConfirmed_time

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Comparing results to identify values that have a certain value in previous records

livehybrid — Fri, 28 Mar 2025 13:25:08 GMT

Here is a working example using makeresults too

| makeresults | eval _raw="EventType=\"Device\" Event=\"InstallProfileConfirmed\" User=\"sysadmin\" EnrollmentUser=\"hasubram\" DeviceFriendlyName=\"blabla MacBook Air macOS 15.3.2 Q6LW\" EventSource=\"Device\" EventModule=\"Devices\" EventCategory=\"Command\" EventData=\"Profile=Apple macOS Apple Intelligence Restrictions\" Event Timestamp: Mar 28 09:29:40" | append [| makeresults | eval _raw="EventType=\"Device\" Event=\"DeviceOperatingSystemChanged\" User=\"sysadmin\" EnrollmentUser=\"hasubram\" DeviceFriendlyName=\"blabla MacBook Air macOS 15.3.2 Q6LW\" EventSource=\"Device\" EventModule=\"Devices\" EventCategory=\"Assignment\" EventData=\"Device=75639\" Event Timestamp: Mar 28 09:29:29"] | kv | rex field=_raw "Event Timestamp: (?<EventTime>.+)$" | eval _time=strptime(EventTime, "%b %d %H:%M:%S") | search DeviceFriendlyName="blabla MacBook Air macOS 15.3.2 Q6LW" | eval {Event}_time=_time | stats latest(*_time) as *_time values(Event) as events by DeviceFriendlyName | where MATCH(events, "DeviceOperatingSystemChanged") AND MATCH(events, "InstallProfileConfirmed") AND DeviceOperatingSystemChanged_time < InstallProfileConfirmed_time

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Comparing results to identify values that have a certain value in previous records

Blueochotona — Fri, 28 Mar 2025 13:56:02 GMT

Very kewl 🙂

Thank you 🙂 Will give it a shot for sure !

Re: Comparing results to identify values that have a certain value in previous records

livehybrid — Fri, 28 Mar 2025 15:22:59 GMT

Excellent, let us know how you get on 🙂

Will