topic Re: Query to Display change in values of fields in Splunk Search

Query to Display change in values of fields

muralianup — Thu, 27 Jul 2017 11:07:55 GMT

I trying to write a query to check the changes in versions of a software. When using timechart (stacked) I can see multiple columns (when there was change in the version of software) and I am trying to display only those days which had occurrence of multiple columns in the graph. Any suggestions ?

Re: Query to Display change in values of fields

somesoni2 — Thu, 27 Jul 2017 12:22:22 GMT

Can you share your query? Without knowing that, my suggestion would be to add following to your existing search.

your current search producing above output
| eval versions=0
| foreach * [eval versions=if('<<FIELD>>' > 0,versions+1,versions)]
| where versions>1 | fields -versions

Re: Query to Display change in values of fields

muralianup — Thu, 27 Jul 2017 12:34:29 GMT

Base query is index=web_prxy domain=abc useragent= | rex filed=useragent "(?P[\d]*)" | timechart count by Version limit=5

Does stereamstats helps ?

Re: Query to Display change in values of fields

niketn — Thu, 27 Jul 2017 16:07:27 GMT

Just extending @somesoni2 's Answer to your scenario.

<YourBaseSearch>
| rename * as Count*
| rename Count_time as _time
| rename Count_span as _span
| eval versions=0
| foreach Count* [eval versions=if(<<FIELD>> > 0,versions+1,versions)]
| search versions>1
| fields - versions
| rename Count* as *

Re: Query to Display change in values of fields

muralianup — Tue, 29 Sep 2020 15:11:57 GMT

The streamstats command helped. Borrowed the concept from one of the Splunk blog entries (on tracking DHCP lease for a particular MAC id).

| streamstats current=false last(Version) as new_Version last(_time) AS time_of_change BY src_ip | where Version!=new_Version | convert ctime(time_of_change) AS time_of_change | rename Version as old_Version | stats count by date_wday

Re: Query to Display change in values of fields

niketn — Thu, 03 Aug 2017 10:25:34 GMT

@muralianup, please accept your Answer to mark the question as answered.