Running an eval after a sub-search make my comparison negative

[mybestfriendbob]

I am trying to make a comparison of one field against itself but from a previous day.  The use case is I'm trying to see if that value changes from day to day, the field is a file hash.  I sun a search for today and rename the field I want to compare then run a subsearch and rename the field again so I can then compare them after the subsearch finishes but the eval always evaluates to false and displays the last response you place in the eval line.  

My code:

index=my_index RuleName="Monitor The File" FileName="file.exe" earliest="06/11/2021:00:00:00" latest="06/11/2021:24:00:00"
| rename FileHash as "todays_hash"
| append [ search index=my_index RuleName="Monitor The File" FileName="file.exe" earliest="06/12/2021:00:00:00" latest="06/12/2021:24:00:00"
| rename FileHash as "yesterdays_hash"]
| eval description=case(todays_hash=yesterdays_hash,"Hash has not changed", todays_hash!=yesterdays_hash,"Hash has changed")
| table description todays_hash yesterdays_hash

I have tried changing the order of the eval putting != before == and it will always take the second options.  The table it showing the eval results and the 2 hashes.

Thanks!

[mybestfriendbob]

That worked perfectly, thanks!

[kamlesh_vaghela]

@mybestfriendbob 

You can try this also.

index=my_index RuleName="Monitor The File" FileName="file.exe" earliest=-1d@d
| eval FileHash = if( _time>=relative_time(now(), "@d"),FileHash,null())
| eval PrevFileHash = if( _time<relative_time(now(), "@d"),FileHash,null())
| stats values(*) as * by FileName 
| eval description=case(FileHash=PrevFileHash,"Hash has not changed", FileHash!=PrevFileHash,"Hash has changed") 
| table FileName description FileHash PrevFileHash

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[richgalloway · Accepted solution]

The append command creates separate events for the results of the subsearch.  IOW, the first set of events will contain a todays_hash field, but not a yesterdays_hash" field and the appended events will contain a yesterdays_hash field, but not a todays_hash field.  The solution is to use the stats command to combine the events on a common field.

index=my_index RuleName="Monitor The File" FileName="file.exe" earliest="06/11/2021:00:00:00" latest="06/11/2021:24:00:00"
| rename FileHash as "yesterdays_hash"
| append [ search index=my_index RuleName="Monitor The File" 
  FileName="file.exe" earliest="06/12/2021:00:00:00" 
  latest="06/12/2021:24:00:00"
| rename FileHash as "todays_hash"]
| stats values(*) as * by FileName
| eval description=case(todays_hash=yesterdays_hash,"Hash has not changed", todays_hash!=yesterdays_hash,"Hash has changed")
| table FileName description todays_hash yesterdays_hash