I have events with this format
10/23/2014 04:00:02 -0300, searchname=CDRINSTITUCIONESAPP, searchnow=1414047600.000, infomaxtime=1414047600.000, infosearchtime=1414047602.224, INSTCODG=9850, INSTESTD=0, INSTNMCR="AFP Habitat", fechacreacion="03-08-2007 08:58:49", fecha_mod="03-08-2007 08:58:49"
I extracted the log from database with Splunk DBX with a scheduled search. I need to find if a difference exists between the current event and the previous event (only 1 previous event not more). If i have a difference, i need show this to detect changes in the accounts.
To identify each unique event the fields are INSTNMCR and INSTCODG
Help me please.
You want to use the command delta to calculate the evolution between 2 events.
example with values raising without sub digits.
mysearch | delta myfield AS evolution p=1 | eval whathappened=case(evolution>=1,"raised",evolution<=1,"went down",1=1,"not changed")
alt textThanks you so much. But if i need to find the difference between two tables, for example my previous results have one table from yesterday with multiple users and today i have the same table but with changes, i need to find the difference between two result tables. the case is always comparing the results of yesterday with today's day (from two tables)
i tried the query but it shows me all events with the field "what happened", i just need to see the changes between current events and only previous events (not all previous event only the previous most recent)
If you see in my attachement the field fecha_mod change but the field whathappened not show the change...
index="cdr_app_instituciones" INST_NMCR="SIISA" | eval INST_CODG=if(INST_CODG="7434","9850",INST_CODG) | search INST_CODG="9850" | stats first(_time) as today_time last(_time) as yest_time first(fecha_mod) as today_fecha_mod last(fecha_mod) as yest_fecha_mod by INST_NMCR | where today_fecha_mod!=yest_fecha_mod