comparing files

[JovanMilosevic]

We have a flat file that contains user data. Changes made to this file are not audited. I'd like Splunk to report on users added or deleted. This is sort of straight forward, in that we can index the file each month. Then search earliest say 32 days,

search ... | transaction user | where duration=0

Will give me records that are singletons, and have either been created or deleted. If the date is last month's, then it has been deleted, and if it's this month, it's beeen added. I can tell this by looking at the dates, but what I'd like to do is evaluate a field that says "Added" or "Deleted".

The date of each transaction will allways be of the form "YYY/MM/01 01:00:00", as the file itself doesn't contain a date, so it is added via a script.

Any ideas ?

[Ayn · Accepted solution]

Use eval to create a field that will say "Deleted" if the event is from last month (or older), and "Added" if it's newer than that.

<yourbasesearch> | eval useraction=if(_time < relative_time(now(),"-1m@m"),"Deleted","Added")

[JovanMilosevic]

Thanks for the speedy response. The relative time should be "-1mon" and I dropped the snap to.