A logon script generates an event every time a user logs into the desktop. Here are the sample events in Splunk from those events - user_A;05/10/13 10:15:01 AM;field1="cat";field2="mouse" user_B;05/10/13 09:01:01 AM;field1="cat";field2="mouse" user_A;05/09/13 09:05:01 AM;field1="mouse";field2="horse" user_B;05/09/13 09:01:01 AM;field1="cat";field2="mouse" user_A;05/08/13 11:05:01 AM;field1="mouse";field2="horse" I want to be able to generate a report when "field1" changes per user, even compared to the last event. In this case I want a report that lists the event "user_A;05/10/13 10:15:01 AM;field1="cat";field2="mouse". Any help would be appreciated. Thanks. ... View more

We use Splunk as a central logging server for both security and IT operations. I would like to know if there is a way to write an alert that will trigger when someone changed the application log level and the size of log files coming into Splunk decreases. I want to be able to monitor that by host. ... View more