Splunk Search

How to find difference between a current event and previous event and display the changes?

armonsal
Explorer

Hello everyone,

I have events with this format

10/23/2014 04:00:02 -0300, search_name=CDR_INSTITUCIONES_APP, search_now=1414047600.000, info_max_time=1414047600.000, info_search_time=1414047602.224, INST_CODG=9850, INST_ESTD=0, INST_NMCR="AFP Habitat", fecha_creacion="03-08-2007 08:58:49", fecha_mod="03-08-2007 08:58:49"

I extracted the log from database with Splunk DBX with a scheduled search. I need to find if a difference exists between the current event and the previous event (only 1 previous event not more). If i have a difference, i need show this to detect changes in the accounts.

To identify each unique event the fields are INST_NMCR and INST_CODG

Help me please.

0 Karma

somesoni2
Revered Legend

Try this

index="cdr_app_instituciones" INST_NMCR="SIISA" | eval INST_CODG=if(INST_CODG="7434","9850",INST_CODG) | search INST_CODG="9850"  | stats first(_time) as today_time last(_time) as yest_time first(fecha_mod)  as today_fecha_mod last(fecha_mod)  as yest_fecha_mod by INST_NMCR | where today_fecha_mod!=yest_fecha_mod
0 Karma

yannK
Splunk Employee
Splunk Employee

You want to use the command delta to calculate the evolution between 2 events.

http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Delta

example with values raising without sub digits.

mysearch | delta myfield AS evolution p=1 | eval whathappened=case(evolution>=1,"raised",evolution<=1,"went down",1=1,"not changed")

0 Karma

armonsal
Explorer

alt textThanks you so much. But if i need to find the difference between two tables, for example my previous results have one table from yesterday with multiple users and today i have the same table but with changes, i need to find the difference between two result tables. the case is always comparing the results of yesterday with today's day (from two tables)

i tried the query but it shows me all events with the field "what happened", i just need to see the changes between current events and only previous events (not all previous event only the previous most recent)

If you see in my attachement the field fecha_mod change but the field whathappened not show the change...
http://answers.splunk.com/storage/attachments/3455-example.png

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...