Locate Changes to Field and Count Them

[enb_splunk]

Hello Splunk Community,

I need to find out how many upgrades were performed to systems and unsure how to best proceed. The data is similar to what is listed below:

_time	hostname	system	model	version
2025-01-01	a	x	x	15.2(8)
2025-01-01	b	y	y	15.3(5)
2025-01-02	a	x	x	15.3(5)

There are thousands of systems with various versions. I am trying to find a way to capture devices that have gone from one version to a newer one indicating an upgrade took place. Multiple upgrades could have occurred over time for a single device and those need to be accounted for as well. Any help suggesting where to start looking into what to use would be greatly appreciated.

Thanks.

-E

[bowesmana]

Like the others, not totally sure what you're after, but given your example data, this SPL

| stats latest(version) as last_version max(_time) as last_time count(version) as count_version dc(version) as dc_version by hostname model system

will tell you the count of version records, the last version/date, the distinct version count for each host/system/model

However, if you want to detect "NEWER" vs going backwards in versions, you'll need to define that rule in the version data.

Also, this will only tell you within the search range, how far back do you want to go?

[ITWhisperer]

It is not clear what you are expecting your result to be. You mention devices but these are not mentioned in your data. Since each event appears to represent a different version, can you not just count the events? Please clarify what you are trying to do, what more of your data looks like and what your expected results would be.

[isoutamo]

Probably the best way to do this is create a lookup file/kvstore collection where you are stored current/earlier versions. Then just create a SPL query which creates current status, then checks what are differences between those two.

If you need exact SPL then please share what you have currently with some sample data with masked identifiers.