How to compare the values with the time and host?

[Anud]

Team,

I am having a query which would result as below.

_time	Host	Name	version
3/2/2022  15:22:04 PM	3	car	248
3/1/2022  15:21:04 PM	3	car	246
3/1/2022  15:20:07PM	2	car	246
3/1/2022  15:20:03 PM	3	bus	600
3/1/2022  15:19:02 PM	2	bus	600
2/1/2022  15:20:03 PM	3	Toy	600
2/1/2022  15:19:02 PM	2	Toy	248
2/1/2022  14:19:02 PM	2	Toy	248

After that i need final output like below.

_time	Host	Name	version	Final
2/1/2022  15:20:03 PM	3	Toy	600	Not matching
3/1/2022  15:20:03 PM	3	bus	600	Matched
3/1/2022  15:21:04 PM	3	car	246	Matched
3/2/2022  15:22:04 PM	3	car	248	Not matching

 I am not sure to compare between columns itself. Could someone please help me out here.

Thanks

[ITWhisperer]

What are your criteria for matching the columns?

[Anud]

Host is the criteria.

We need to check host latest and earliest time in a day... accordingly thier names and version have to compare.

Thankyou

[ITWhisperer]

Why is bus/600 matched when there is a host with a different number on the same day?

Why is car/248 not matched when there isn't another entry for the same day?

[Anud]

Here target is to check the version for the host and their names.

So we have only 2hosts...final version is compared to 2and 3hosts with their same names.

Sometimes it takes to another day,so we need compare pervious day host latest time.

Thank you

[ITWhisperer · Accepted solution]

| eventstats dc(Host) as hosts by Name version
| stats latest(_time) as _time latest(Host) as Host by Name version hosts
| eval Final=if(hosts = 2, "Matched","Not matching")

[Anud]

Thank you !!