How to get change events only?

[eranhauser]

I  have events with the following keys: key1, key2 & key3.

I would like to get the change events i.e. events that their key1, key2 & key3 values are not in the events of previous day. 

What should the query look like?

[bowesmana]

What data is the correlation between the same event - please give an example of the data you may see and what you would expect.

For example, if you have an event yesterday with 

key1=A, key2=B,key3=C

and an event today with

key1=A, key2=B,key3=D

what do you want to show? If you have lots of events with different fields, is there some common object that connects those events to today's events?

[eranhauser]

a change event is considered if any combination of key1, key2 & key3 is new. In your example key1=A, key2=B,key3=D will be considered as a new event.

[bowesmana]

then something like

index=your_index earliest=-1d@d latest=now()
``` Collect all combinations of key 1, 2 and 3 by day ```
| bin _time span=1d
| stats count by _time key1 key2 key3
``` Count the number of days these key combinations occur ```
| stats dc(_time) as times list(_time) as days by key1 key2 key3
``` and then if there is only 1 variant and it is today, it's a new type ```
| where times=1 AND days=relative_time(now(), "@d")

[eranhauser]

There should be something similar to SQL in splunk like right outer joint no? 

[bowesmana]

There is a join command, but it is NOT the first, second or third choice for a Splunk solution - you can and should always use stats to join data. join has limitations, requires a second search to do the join data.

This stats command is effectively calculating all the similar triplets by time and where there are two times (e.g. 2 days) you have a non-change event, so discard it.