Splunk Search

Comparing data between rows and show only needed result

flukey
Engager

Hi Splunker

 

I'm quite new to splunk. Can you please help me out on this search?

I have a table of antivirus database version of each servers.

Server       |          database version
A                                          5

B                                          4

C                                          4

D                                          3

E                                           5

Assume that A is my main server and the rest download from A. So I wanna compare the rest database version with A and display only the servers that version is less than A

so the expected result will be

Server       |          database version
B                                          4

C                                          4

D                                          3

 

Labels (5)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@flukey 

Try some thing like this.

YOUR_SEARCH
| eventstats max(eval(if(Server=="A",database_version,null()))) as A_database_version
| where database_version< A_database_version | fields - A_database_version

 

My Sample Search :

| makeresults | eval _raw="Server,database_version
A,5
B,4
C,4
D,3
E,5"| multikv forceheader=1
| table Server,database_version
| rename comment as "Upto Now is sample data only" 
| eventstats max(eval(if(Server=="A",database_version,null()))) as A_database_version
| where database_version< A_database_version | fields - A_database_version

 

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
 

View solution in original post

0 Karma

flukey
Engager

Hi Kamlesh

Thank your very much for your help!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@flukey 

Try some thing like this.

YOUR_SEARCH
| eventstats max(eval(if(Server=="A",database_version,null()))) as A_database_version
| where database_version< A_database_version | fields - A_database_version

 

My Sample Search :

| makeresults | eval _raw="Server,database_version
A,5
B,4
C,4
D,3
E,5"| multikv forceheader=1
| table Server,database_version
| rename comment as "Upto Now is sample data only" 
| eventstats max(eval(if(Server=="A",database_version,null()))) as A_database_version
| where database_version< A_database_version | fields - A_database_version

 

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...