Compare results from same field

[CyberWolf]

I'm using cmd |iplocation src, and the results produce results for the City. Next i want to compare each City and report when results is different.

Example when result for a City is Miami and next hour or so  in the same field for the City is Boston.

[CyberWolf]

Thanks Everyone for fast response!

[gcusello]

Hi @CyberWolf ,

I suppose that you want to check this for each Account_name, you could try with stats:

<your_search>
| iplocation src
| stats dc(city) AS city_count BY Account_name
| where city_count>1

use the Account_name field you have in your logs.

Ciao.

Giuseppe

[ITWhisperer · Accepted solution]

| streamstats latest(city) as previous current=f

[CyberWolf]

It worked! thank you!

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.