Splunk Search

How to find difference between a current event and previous event and display the changes?


Hello everyone,

I have events with this format

10/23/2014 04:00:02 -0300, search_name=CDR_INSTITUCIONES_APP, search_now=1414047600.000, info_max_time=1414047600.000, info_search_time=1414047602.224, INST_CODG=9850, INST_ESTD=0, INST_NMCR="AFP Habitat", fecha_creacion="03-08-2007 08:58:49", fecha_mod="03-08-2007 08:58:49"

I extracted the log from database with Splunk DBX with a scheduled search. I need to find if a difference exists between the current event and the previous event (only 1 previous event not more). If i have a difference, i need show this to detect changes in the accounts.

To identify each unique event the fields are INST_NMCR and INST_CODG

Help me please.

0 Karma

Revered Legend

Try this

index="cdr_app_instituciones" INST_NMCR="SIISA" | eval INST_CODG=if(INST_CODG="7434","9850",INST_CODG) | search INST_CODG="9850"  | stats first(_time) as today_time last(_time) as yest_time first(fecha_mod)  as today_fecha_mod last(fecha_mod)  as yest_fecha_mod by INST_NMCR | where today_fecha_mod!=yest_fecha_mod
0 Karma

Splunk Employee
Splunk Employee

You want to use the command delta to calculate the evolution between 2 events.


example with values raising without sub digits.

mysearch | delta myfield AS evolution p=1 | eval whathappened=case(evolution>=1,"raised",evolution<=1,"went down",1=1,"not changed")

0 Karma


alt textThanks you so much. But if i need to find the difference between two tables, for example my previous results have one table from yesterday with multiple users and today i have the same table but with changes, i need to find the difference between two result tables. the case is always comparing the results of yesterday with today's day (from two tables)

i tried the query but it shows me all events with the field "what happened", i just need to see the changes between current events and only previous events (not all previous event only the previous most recent)

If you see in my attachement the field fecha_mod change but the field whathappened not show the change...

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...