Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- comparing files
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have a flat file that contains user data. Changes made to this file are not audited. I'd like Splunk to report on users added or deleted. This is sort of straight forward, in that we can index the file each month. Then search earliest say 32 days,
search ... | transaction user | where duration=0
Will give me records that are singletons, and have either been created or deleted. If the date is last month's, then it has been deleted, and if it's this month, it's beeen added. I can tell this by looking at the dates, but what I'd like to do is evaluate a field that says "Added" or "Deleted".
The date of each transaction will allways be of the form "YYY/MM/01 01:00:00", as the file itself doesn't contain a date, so it is added via a script.
Any ideas ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use eval to create a field that will say "Deleted" if the event is from last month (or older), and "Added" if it's newer than that.
<yourbasesearch> | eval useraction=if(_time < relative_time(now(),"-1m@m"),"Deleted","Added")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use eval to create a field that will say "Deleted" if the event is from last month (or older), and "Added" if it's newer than that.
<yourbasesearch> | eval useraction=if(_time < relative_time(now(),"-1m@m"),"Deleted","Added")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the speedy response. The relative time should be "-1mon" and I dropped the snap to.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
