I have this code bellow and i want to just keep with lines of when my Virtual Machine changed Cluster ou VMhost.
Obs.: I cant use "dedup" because i have VMs that was moved to the same cluster twice.![alt text][1]
earliest=03/01/2018:00:00:00 latest=03/31/2018:23:59:00 sourcetype="VCENTER_VMS_INFO"
| eval VM=upper(VM)
| table _time VM VMhost Cluster
| where VM="VMName" | bucket span=1h _time | stats values(VMhost) as VMhost values(Cluster) as Cluster by _time VM |
Give this a try
earliest=03/01/2018:00:00:00 latest=03/31/2018:23:59:00 sourcetype="VCENTER_VMS_INFO"
| eval VM=upper(VM)
| table _time VM VMhost Cluster
| where VM="DCDEV00027" | bucket span=1h _time | stats values(VMhost) as VMhost values(Cluster) as Cluster by _time VM
| streamstats current=f window=1 values(VMhost) as prevVMhost values(Cluster) as prevCluster by VM
| whehre VMhost!=prevVMhost OR Cluster!=prevCluster
You can use autoregress to get the value from previous row and compare it with current row value. Something like below
| autoregress VMhost as Old_VMhost | eval Flag=if(VMhost==Old_VMhost ,"N","Y") | where Flag="Y"
Give this a try
earliest=03/01/2018:00:00:00 latest=03/31/2018:23:59:00 sourcetype="VCENTER_VMS_INFO"
| eval VM=upper(VM)
| table _time VM VMhost Cluster
| where VM="DCDEV00027" | bucket span=1h _time | stats values(VMhost) as VMhost values(Cluster) as Cluster by _time VM
| streamstats current=f window=1 values(VMhost) as prevVMhost values(Cluster) as prevCluster by VM
| whehre VMhost!=prevVMhost OR Cluster!=prevCluster
It works as i was hoping, thanks for your help!!!