All Apps and Add-ons

Display value from field if value from other field changes within x mins

jbesant
Explorer

Hello, I am after some help to define the search that will display a list of field values if the value in another field changes from one value to another within a certain time frame

For example, I want to see the value of the field ID if the value of the field Loc changes from ABC to DEF within 30 minutes.

Thanks in advance.

Tags (1)
1 Solution

somesoni2
Revered Legend

My guess will be that You could try transaction command on the ID field. May be something like this

your base search | transaction ID maxspan=30m startswith=ID=ABC endswith=ID=DEF | table your fields 

View solution in original post

somesoni2
Revered Legend

My guess will be that You could try transaction command on the ID field. May be something like this

your base search | transaction ID maxspan=30m startswith=ID=ABC endswith=ID=DEF | table your fields 

jbesant
Explorer

Thanks. I made a small modification and that gave me exactly what I wanted. It showed all the locations (Loc) within the 30 minutes time window of the ID. Appreciated.

my search | transaction ID maxspan=30m startswith=Loc=ABC endswith=Loc=DEF | table ID Loc
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...