How to compare events and show if there is any difference?

[vrmandadi]

I am trying to write a search that will compare data for the latest event with its previous event and show the difference if any for each host .I am trying to use earliest and latest event but I earliest doesnt take the immediate  preceding event 

Following is the search I have tried but I dont think its right

index=abc host=xyz
| stats latest(id) as id  latest(SN) as SN latest(PN) as PN  latest(_time) as time by host
|stats earliest(id) as eid   earliest(SN) as eSN  earliest(PN) as ePN   earliest(_time) as etime by host

Thanks in Advance Splunkers

[ITWhisperer]

Try something like this

index=abc host=xyz
| sort 0 _time
| streamstats window=1 current=f global=f latest(id) as pid latest(SN) as pSN latest(PN) as pPN  latest(_time) as ptime by host
| reverse
| dedup host

You can now compare id with pid, SN with pSN etc.

[vrmandadi]

@ITWhisperer  I tried your search but It did not result in any results...I am not sure how your search shows the difference if you only have latest in it

| streamstats window=1 current=f global=f latest(id) as pid latest(SN) as pSN latest(PN) as pPN latest(_time) as ptime by GPU

[ITWhisperer]

Are you using host, GU or GPU?

index=abc host=xyz
| sort 0 _time
| streamstats window=1 current=f global=f latest(id) as pid latest(SN) as pSN latest(PN) as pPN  latest(_time) as ptime by GPU
| reverse
| dedup GPU

Streamstats add the fields to each event, the reverse then dedup keeps the first event for each GPU (GU / host / whatever)

[vrmandadi]

@ITWhisperer  raw data coming in but no statistical data for that search

[ITWhisperer]

Perhaps you could share some events so we can see what it is you are dealing with. Obviously, you should anonymise any personal or sensitive values. Please share them in a code block </>. Also if you could identify which fields you already have extracted, that would be helpful.

[inventsekar]

Hi @vrmandadi ...

>> I am trying to write a search that will compare data for the latest event with its previous event and show the difference if any for each host.

your search query does not include any compare options.. bit confusing actually.. 

Maybe, please try this... 

index=abc host=xyz 
| stats latest(id) as id, earliest(id) as eid, latest(SN) as SN, earliest(SN) as eSN, latest(PN) as PN, earliest(PN) as ePN, earliest(_time) as etime, latest(_time) as time by host

[vrmandadi]

hello @inventsekar  .Sorry if my question is bit confusing...I am basically trying to compare events and show the difference if any but I dont know how to do it...so I dont have any comparison operators ..Your search gives earliest and latest data for a particular time range..but it doesnt exactly compare the successive events .

I am trying to the search by using a by clause on field "GU" which has 8 values  ..I am not sure how to compare 

| stats latest(id) as id, earliest(id) as eid, latest(SN) as SN, earliest(SN) as eSN, latest(PN) as PN, earliest(PN) as ePN, earliest(_time) as etime, latest(_time) as time by GU