Splunk Search

Compare results from same field

CyberWolf
Path Finder

I'm using cmd |iplocation src, and the results produce results for the City. Next i want to compare each City and report when results is different.

Example when result for a City is Miami and next hour or so  in the same field for the City is Boston.

Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats latest(city) as previous current=f

View solution in original post

CyberWolf
Path Finder

Thanks Everyone for fast response!

gcusello
SplunkTrust
SplunkTrust

Hi @CyberWolf ,

I suppose that you want to check this for each Account_name, you could try with stats:

<your_search>
| iplocation src
| stats dc(city) AS city_count BY Account_name
| where city_count>1

use the Account_name field you have in your logs.

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats latest(city) as previous current=f

CyberWolf
Path Finder

It worked! thank you!

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...