Splunk Search

What is the best way to count the number of times a field has been changed or toggled?

606866581
Path Finder

Hi Everyone,

I've been using Splunk for a few years but I'm looking for a nice way to capture the number of times a user has changed a particular setting. For simplicity sake the setting can be 1 or 0.

2017-02-17 01:00:00 IP=1.1.1.1 Setting=0
2017-02-17 02:00:00 IP=1.1.1.1 Setting=0
2017-02-17 03:00:00 IP=1.1.1.1 Setting=1
2017-02-17 03:00:00 IP=2.2.2.2 Setting=0
2017-02-17 04:00:00 IP=2.2.2.2 Setting=1
2017-02-17 05:00:00 IP=1.1.1.1 Setting=0
2017-02-17 05:00:00 IP=1.1.1.1 Setting=0

I'm looking to produce a table to summarize this which will look like:

IP, Times toggled
1.1.1.1, 2
1.1.1.1, 1

The dataset is too large to use transaction so I'm hoping there's a nifty command that I can use which caters for this.
Thanks!

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

your current search which include fields _time IP and Setting
| sort 0 IP _time
| streamstats current=f window=1 values(Setting) as prevSetting by IP 
| where Setting!=prevSetting
| stats count as "Times Toggled" by IP

View solution in original post

somesoni2
Revered Legend

Give this a try

your current search which include fields _time IP and Setting
| sort 0 IP _time
| streamstats current=f window=1 values(Setting) as prevSetting by IP 
| where Setting!=prevSetting
| stats count as "Times Toggled" by IP

niketn
Legend

You can try streamstats

<Your Base Search>
| streamstats count by IP reset_on_change=true

Please refer to the documentation on the same: http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Streamstats

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...