All Apps and Add-ons

Display value from field if value from other field changes within x mins

jbesant
Explorer

Hello, I am after some help to define the search that will display a list of field values if the value in another field changes from one value to another within a certain time frame

For example, I want to see the value of the field ID if the value of the field Loc changes from ABC to DEF within 30 minutes.

Thanks in advance.

Tags (1)
1 Solution

somesoni2
Revered Legend

My guess will be that You could try transaction command on the ID field. May be something like this

your base search | transaction ID maxspan=30m startswith=ID=ABC endswith=ID=DEF | table your fields 

View solution in original post

somesoni2
Revered Legend

My guess will be that You could try transaction command on the ID field. May be something like this

your base search | transaction ID maxspan=30m startswith=ID=ABC endswith=ID=DEF | table your fields 

jbesant
Explorer

Thanks. I made a small modification and that gave me exactly what I wanted. It showed all the locations (Loc) within the 30 minutes time window of the ID. Appreciated.

my search | transaction ID maxspan=30m startswith=Loc=ABC endswith=Loc=DEF | table ID Loc
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...