Splunk Search

How to compare same field values at different times?

muralianup
Communicator

How can I do a comparison with values from same field at different times? The logs belongs to the same index/sourcetype. There's a field called lagtime which basically denotes how long it took to complete a process/action. Goal is to compare the lagtime at current time with lagtime in past 12 hours and display the results only if there is no match.

0 Karma

Masa
Splunk Employee
Splunk Employee

Can you give us sample logs?

0 Karma

sundareshr
Legend

Try this

... earliest=-12h@h | eventstats latest(lagtime) as currentlagtime | where currentlagtime!=lagtime | ...
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...