Splunk Search

Validate changes through SPL


Hi, We are going to deploy changes which will delete certain package from instance. We want to know whether this package is getting deleted after the changes goes through. We are capturing this data in Splunk. 

So Let's say we have package=abc We can find if package exist using following SPL:



index=osstats sourcetype=package "abc"
| bin _time span=1d 
| multikv fields NAME 
| eval package_exist=if(like(NAME,"abc%"),1,0) 
| eval package_name=if(like(NAME,"abc%"),NAME,NULL) 
| stats count by _time host package_exist package_name



Following index is polling data hourly therefore if search for last 24 hours, it will report count=24, host=abc.com,package_exist=1, package_name=abc

Now I have created lookup table from this for last 1 year worth of data. 

What i want to know is, suppose I have host (doesn't have to be part of above query), I want to check if it had package earlier and now it is getting removed. 

I am not sure how I can go above doing that. 

Labels (2)


Assuming your index has been populated every hour for the past year, your query appears to get the daily count of the number of hours each abc package existed on each host.  The package doesn't have to exist on the host now. Why isn't what you already have sufficient?


Because I am filtering with "abc". So technically package exist is rhetorical as it always gonna give 1 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...