How I compare multivalued fields over time?

[jambajuice]

I perform a search that has results like the following where dest_port is a multivalued field:

There are three fields in the results: _time, dest_ip, and dest_port. The results look like:

1/1/11, 192.168.2.200, 80 139 445 8000 9997 (the dest_port field is multivalued)

1/8/11, 192.168.2.200, 22 443 139 445 9997

So, in this example, after one week, ports 80 and 8000 were not present in the results and ports 443 and 22 newly appeared.

How do I write a search that will list the ports that are present in the first event but not the second? How do I write a search that will list the ports that are present in the second event and not in the first event?

The search results will contain multiple events, so I don't think the diff command will work since you have to statically define pos1 and pos2. I can use the dedup command to ensure that only the two most recent events for each host are present in the search results, but I don't know how to compare the contents of the multi-value dest_port field by dest_ip.

Thanks!

Craig

[Ron_Naken]

I believe your answer is here: http://answers.splunk.com/questions/11287/comparing-multivalue-fields

[sideview]

It's definitely some tricky country you're getting into but I would look at the mvexpand command. I feel like there's a way to mvexpand the port field and then just use dedup and/or stats to get your answer. I'll try and write more if i have another free moment.

[jambajuice]

Thanks, Nick. I appreciate it.