I have two kinds of logs
sourcetype = abc IP = a.b.c.d status=active sourcetype = abc IP = a.b.c.e status=active sourcetype = abc IP = a.b.c.f status=active sourcetype = abc IP = x.x.x.x status=inactive sourcetype = abc IP = a.b.c.d status=inactive
I want to get a list of IP with status=active, but IP with whose status has changed to inactive should get filtered out.
Like in the example output should be:
You can try the following:
<YourBaseSearch> sourcetype="abc" IP=* status="active" OR status="inactive" | stats dc(status) as StatusCount values(status) as status by IP | search status="active" AND status!="inactive"