Splunk Search

Log filtering based on field value change.

Explorer

I have two kinds of logs

sourcetype = abc IP = a.b.c.d status=active
sourcetype = abc IP = a.b.c.e status=active
sourcetype = abc IP = a.b.c.f status=active
sourcetype = abc IP = x.x.x.x status=inactive
sourcetype = abc IP = a.b.c.d status=inactive

I want to get a list of IP with status=active, but IP with whose status has changed to inactive should get filtered out.

Like in the example output should be:
a.b.c.e
a.b.c.f

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this.

 sourcetype = abc | dedup IP | where status="active"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Legend

Hi rakes568
try something like this:
sourcetype = abc (status=active OR status=inactive)
| transaction IP
| search NOT status=inactive
| table IP

Bye.
Giuseppe

0 Karma

SplunkTrust
SplunkTrust

You can try the following:

<YourBaseSearch> sourcetype="abc" IP=* status="active" OR status="inactive"
| stats dc(status) as StatusCount values(status) as status by IP
| search status="active" AND status!="inactive"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust

Try this.

 sourcetype = abc | dedup IP | where status="active"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma