Splunk Search

comparing files

Path Finder

We have a flat file that contains user data. Changes made to this file are not audited. I'd like Splunk to report on users added or deleted. This is sort of straight forward, in that we can index the file each month. Then search earliest say 32 days,

search ... | transaction user | where duration=0

Will give me records that are singletons, and have either been created or deleted. If the date is last month's, then it has been deleted, and if it's this month, it's beeen added. I can tell this by looking at the dates, but what I'd like to do is evaluate a field that says "Added" or "Deleted".

The date of each transaction will allways be of the form "YYY/MM/01 01:00:00", as the file itself doesn't contain a date, so it is added via a script.

Any ideas ?

1 Solution

Legend

Use eval to create a field that will say "Deleted" if the event is from last month (or older), and "Added" if it's newer than that.

<yourbasesearch> | eval useraction=if(_time < relative_time(now(),"-1m@m"),"Deleted","Added")

View solution in original post

Legend

Use eval to create a field that will say "Deleted" if the event is from last month (or older), and "Added" if it's newer than that.

<yourbasesearch> | eval useraction=if(_time < relative_time(now(),"-1m@m"),"Deleted","Added")

View solution in original post

Path Finder

Thanks for the speedy response. The relative time should be "-1mon" and I dropped the snap to.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!