Splunk Search

How can I compare the most recent field extraction in a log to the previous one?



I have a log file which produces a MD5sum every hour or so. I'd like to compare the most recent event, with the previous event. if the md5sum changed, then alert.

5:00pm md5sum=Aaaaaaaaaaaaaaaaaaaaaaaaaa file=/etc/ssh/ssh_config
5:00pm md5sum=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx file=/someotherfile
6:00pm md5sum=Bbbbbbbbbbbbbbbbbbbbbbb file=/etc/ssh/ssh_config

Any easy trick to this?

0 Karma

Esteemed Legend

Like this:

| makeresults 
| eval raw="6:00pm md5sum=Bbbbbbbbbbbbbbbbbbbbbbb file=/etc/ssh/ssh_config:::5:00pm md5sum=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx file=/someotherfile:::5:00pm md5sum=Aaaaaaaaaaaaaaaaaaaaaaaaaa file=/etc/ssh/ssh_config"
| makemv delim=":::" raw
| mvexpand raw
| rename raw AS _raw
| rex "md5sum=(?<md5sum>\S+)\s+file=(?<file>\S+)"
| reverse
| streamstats current=f last(md5sum) AS prev_md5sum BY file
| where md5sum!=prev_md5sum
0 Karma


This can be done by using stream stats command
Check this query .

|makeresults |eval md5 ="22,33,33"|eval md5 = split(md5,",") |mvexpand md5| streamstats current=f global=f window=1 last(md5) as last_md5 |eval match = if(md5 == last_md5,"match","nomatch") |where match = "nomatch"


0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...