Splunk Search

How to compare when a field value changes from current to previous?

Glasses
Builder

I am looking to find events where IP address changes from previous to current, however using fist(ip) and last(ip) misses the events in between the first and last...

Ideally I am looking to find when a change occurs for the IP value and then look at the previous IP value... this comparison is then used to find ip geoloc and calc the speed = dist/time with haversine app.

Thank you

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Look at the streamstats command for this. Any tracking of change over time, streamstats is your go-to verb.

We'll assume there is a key called user.

your search that gets the records you want, with at least these fields  
| fields _time user someIP
| sort 0 _time 
| streamstats current=f last(someIP) as priorIP last(_time) as priorTime  by user
| where NOT (someIP=priorIP)
 ... the remainder of your search. 

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Look at the streamstats command for this. Any tracking of change over time, streamstats is your go-to verb.

We'll assume there is a key called user.

your search that gets the records you want, with at least these fields  
| fields _time user someIP
| sort 0 _time 
| streamstats current=f last(someIP) as priorIP last(_time) as priorTime  by user
| where NOT (someIP=priorIP)
 ... the remainder of your search. 
0 Karma

Glasses
Builder

Wow that is awesome!!! Thanks

DalJeanis
SplunkTrust
SplunkTrust

You are quite welcome. streamstats processes the records in order, remembering only the records it has already seen, so you must sort the records in the order you want before you apply the command.

0 Karma

Glasses
Builder

so that is the purpose of sort 0 > return all results, thanks

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...