Log filtering based on field value change.

[rakes568]

I have two kinds of logs

sourcetype = abc IP = a.b.c.d status=active
sourcetype = abc IP = a.b.c.e status=active
sourcetype = abc IP = a.b.c.f status=active
sourcetype = abc IP = x.x.x.x status=inactive
sourcetype = abc IP = a.b.c.d status=inactive

I want to get a list of IP with status=active, but IP with whose status has changed to inactive should get filtered out.

Like in the example output should be:
a.b.c.e
a.b.c.f

[gcusello]

Hi rakes568
try something like this:
sourcetype = abc (status=active OR status=inactive)
| transaction IP
| search NOT status=inactive
| table IP

Bye.
Giuseppe

[niketn]

You can try the following:

<YourBaseSearch> sourcetype="abc" IP=* status="active" OR status="inactive"
| stats dc(status) as StatusCount values(status) as status by IP
| search status="active" AND status!="inactive"

[richgalloway · Accepted solution]

Try this.

 sourcetype = abc | dedup IP | where status="active"