topic Re: How I compare multivalued fields over time? in Splunk Search

How I compare multivalued fields over time?

jambajuice — Fri, 21 Jan 2011 04:48:51 GMT

I perform a search that has results like the following where dest_port is a multivalued field:

There are three fields in the results: _time, dest_ip, and dest_port. The results look like:

1/1/11, 192.168.2.200, 80 139 445 8000 9997 (the dest_port field is multivalued)

1/8/11, 192.168.2.200, 22 443 139 445 9997

So, in this example, after one week, ports 80 and 8000 were not present in the results and ports 443 and 22 newly appeared.

How do I write a search that will list the ports that are present in the first event but not the second? How do I write a search that will list the ports that are present in the second event and not in the first event?

The search results will contain multiple events, so I don't think the diff command will work since you have to statically define pos1 and pos2. I can use the dedup command to ensure that only the two most recent events for each host are present in the search results, but I don't know how to compare the contents of the multi-value dest_port field by dest_ip.

Thanks!

Craig

Re: How I compare multivalued fields over time?

sideview — Fri, 21 Jan 2011 07:38:15 GMT

It's definitely some tricky country you're getting into but I would look at the mvexpand command. I feel like there's a way to mvexpand the port field and then just use dedup and/or stats to get your answer. I'll try and write more if i have another free moment.

Re: How I compare multivalued fields over time?

jambajuice — Fri, 21 Jan 2011 07:39:28 GMT

Thanks, Nick. I appreciate it.

Re: How I compare multivalued fields over time?

Ron_Naken — Fri, 04 Feb 2011 11:38:48 GMT

I believe your answer is here: http://answers.splunk.com/questions/11287/comparing-multivalue-fields