By "splunk table", I assume you mean the results of a search as it appears in your screenshot. If this is the case, you can compare the current data to a previous time's data. The search below will retrieve the unique data from the previous five minutes but only if it is not present in the previous day outside that five minute window. index=<your_index> sourcetype=<your_sourcetype> earliest=-5m latest=now | table key Plugin_version Release | search NOT [ | search index=<your_index> sourcetype=<your_sourcetype> earliest=-1d latest=-5m | table key Plugin_version Release ]   ... View more

Do you want to do this at search time or at index time? Should the data between semicolons be separate events? ... View more

Update: I got it to work by first combining the respective coordinates with mvzip, then breaking the pairs apart again with mvexpand and finally creating latitude and longitude fields with regex capture groups. Hope it can help somebody else! | head 1 | spath output=event.latitude path=events.data{}.place.location.latitude | spath output=event.longitude path=events.data{}.place.location.longitude | table event.latitude, event.longitude | eval test = mvzip('event.latitude', 'event.longitude', ";") | fields - event.* | mvexpand test | rex field=test "(?<latitude>.);(?<*longitude>.*)" | fields - test | geostats latfield=latitude longfield=longitude count ... View more

@rsantkumar This question has an accepted answer. If the solution does not work for you then please post a new question. ... View more