How to spot any changes to the value of a field

[ByteKnight101]

Hello,

I have an index where data is ingested once a week. Objective of ingesting this data is to identify if there is any change to a field value from last week to current. I need help writing a SPL that can help me detect the change if there is one.

For more context here's an example, The relevant fields are:

Role

Entitlement

I need to find out if there has been any change to the entitlements to that role between data ingested on this Saturday and the past. Any help would be appreciated.

Thanks

[ITWhisperer]

Depending on your data (which it would have been useful for you to share), you might be able to count the occurrences of each entitlement for each role for last Saturday and the previous Saturday, and where the count in not 2, there has been a change.