Splunk Dev

Difference between 2 fields using the diff command does not yield the same result

BlueTurtleM
New Member

I am comparing a user list field from an index that runs a collection every 30 minutes. I do a comparison of these 2 events and search for the + or - . If it is + user has been added and if it is a - the user has been deleted.

The problem I am having is that the somehow the events ( 15 mins apart) are not coming through in the "right order".

2019-11-22 15:00 John Doe User Removed
2019-11-22 15:00 Jane Doe User Added

Press the search button again maybe 2 times ( No changes to time... just basically search again) I get ..

2019-11-22 15:00 Jane Doe User Removed
2019-11-22 15:00 John Doe User Added

Names have changed around.

Is this a bug in Splunk? ( I can replicate this over and over...)

Tags (1)
0 Karma

woodcock
Esteemed Legend

Open a support case and then come back here and tell us what you find out!

0 Karma

BlueTurtleM
New Member

I opened a support case and it looks like when the events are returned the diff command, irrespective of when the events arrived, would compare the events. This lead to the difference in the comparison between the 2 events. To resolve this issue we forced the events to be sorted before we did the diff command. At the moment it is working for now.

0 Karma

arjunpkishore5
Motivator

What is your base search? We will be unable to determine the issue without looking at your query.

0 Karma

BlueTurtleM
New Member

index= cn = ""

| diff pos1=1 pos2=2 attribute=member_name

I then extract the username and do an eval case on the + and - which then does the added or removed.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...