Help with events data!

[ppatrikfr]

I have this code bellow and i want to just keep with lines of when my Virtual Machine changed Cluster ou VMhost.

Obs.: I cant use "dedup" because i have VMs that was moved to the same cluster twice.![alt text][1]

earliest=03/01/2018:00:00:00 latest=03/31/2018:23:59:00 sourcetype="VCENTER_VMS_INFO"
| eval VM=upper(VM)
| table _time VM VMhost Cluster
| where VM="VMName" | bucket span=1h _time | stats values(VMhost) as VMhost values(Cluster) as Cluster by _time VM |

[pradeepkumarg]

You can use autoregress to get the value from previous row and compare it with current row value. Something like below

| autoregress VMhost as Old_VMhost  | eval Flag=if(VMhost==Old_VMhost ,"N","Y") | where Flag="Y"

[somesoni2 · Accepted solution]

Give this a try

earliest=03/01/2018:00:00:00 latest=03/31/2018:23:59:00 sourcetype="VCENTER_VMS_INFO" 
| eval VM=upper(VM) 
| table _time VM VMhost Cluster 
| where VM="DCDEV00027" | bucket span=1h _time | stats values(VMhost) as VMhost values(Cluster) as Cluster by _time VM 
| streamstats current=f window=1 values(VMhost) as prevVMhost values(Cluster) as prevCluster by VM 
| whehre VMhost!=prevVMhost OR Cluster!=prevCluster

[ppatrikfr]

It works as i was hoping, thanks for your help!!!