Alert when host sends different data in event

[rtadams89]

Every day, a script runs on my Windows boxs that sends an event to Splunk. I'm looking for a search that will return the difference between the most recent event from each host, and the second most recent event from each host.

My hope is that I can create a search that will show me what has changed between the last time the script ran and the previous time the script ran.

[woodcock]

Add this to your existing search which is returning your stuff:

... | eventstats dc(linecount) AS numValues by host | where numValues>1

[rtadams89]

"Delta" would not work, as it doesn't take factor in the different hosts. I need to essentially do a "Delta" recursively for each host and then return only those hosts where the delta != 0.

[rtadams89]

Each server sends a list of user accounts (one per line, as a single event) to Splunk. I want to find changes to the users by comparing the previous events to the current events (comparing the linecount value). As a server may not report in each day, I pipe all the events through a "dedup 2 host" command to get a list of the last two events from each host. The results of this (tabled) look like

host | linecount

host1 | 10

host1 | 10

host2 | 3

host2 | 4

host3 | 1

host3 | 1

What I need is a command I can use to return only the "host2" events (as it's the only one that had a change).

[lguinn2]

Can you give us a little more info about the events? Also, have you looked at the delta command?
http://docs.splunk.com/Documentation/Splunk/4.2.4/SearchReference/Delta