Splunk Search

How can I compare the most recent field extraction in a log to the previous one?



I have a log file which produces a MD5sum every hour or so. I'd like to compare the most recent event, with the previous event. if the md5sum changed, then alert.

5:00pm md5sum=Aaaaaaaaaaaaaaaaaaaaaaaaaa file=/etc/ssh/ssh_config
5:00pm md5sum=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx file=/someotherfile
6:00pm md5sum=Bbbbbbbbbbbbbbbbbbbbbbb file=/etc/ssh/ssh_config

Any easy trick to this?

0 Karma

Esteemed Legend

Like this:

| makeresults 
| eval raw="6:00pm md5sum=Bbbbbbbbbbbbbbbbbbbbbbb file=/etc/ssh/ssh_config:::5:00pm md5sum=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx file=/someotherfile:::5:00pm md5sum=Aaaaaaaaaaaaaaaaaaaaaaaaaa file=/etc/ssh/ssh_config"
| makemv delim=":::" raw
| mvexpand raw
| rename raw AS _raw
| rex "md5sum=(?<md5sum>\S+)\s+file=(?<file>\S+)"
| reverse
| streamstats current=f last(md5sum) AS prev_md5sum BY file
| where md5sum!=prev_md5sum
0 Karma


This can be done by using stream stats command
Check this query .

|makeresults |eval md5 ="22,33,33"|eval md5 = split(md5,",") |mvexpand md5| streamstats current=f global=f window=1 last(md5) as last_md5 |eval match = if(md5 == last_md5,"match","nomatch") |where match = "nomatch"


0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

Splunk Cloud Platform | New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...