Splunk Search

Field Extraction Issue - Need True/False comparison of all Values to Max Value of Same Field

BinaryAddict
Engager

I'm wanting to avoid using saved searches and lookup tables as much if possible so it's easily maintainable by anyone on the team. Also, I'm wanting to make it as future proof as possible so it "just works" with little need to update or modify.

My end goal is to create a query that produces a True/False (or equivalent) result for each value when compared to the max value of the same field. To explain in more detail: I'm wanting the query to use the latest version of the Trellix/McAfee Agent reported in Splunk and then compare that value against the full set and return True/False if the numbers match.
I can get exactly what I need using the query below, but it needs to be manually updated every time the Agent version is updated.

 

source=trellix AgentVer=*
| eval AgentStatus=if(AgentVer=="5.7.9.182", "True","False")
| stats count BY AgentStatus

 

Simple

Where this gets complicated is when I try to isolate the latest version. I've tried all kinds of ways to extract that version number and put it into its own field and then do the comparison and nothing I've tried works. 

Here's an example of what I have tried, but this is not exhaustive because I've tried 500 different ways... 😄

 

<!-- This query produces the version I need into a new field -->
source=trellix AgentVer=*
| stats max(AgentVer) AS TAV

<!-- Then I try to compare the value in the new TAV field to the old field -->
source=trellix AgentVer=*
| stats max(AgentVer) AS TAV
| eval Status=if(AgentVer==TAV, "True","False")
| table Status

<!-- No good -->
<!-- So then I try to take it a step further -->
source=trellix AgentVer=*
| stats max(AgentVer) AS TAV
| rex field=TAV (?<TA>"^(?:^\d+(\.\d+)+$)")
| eval Status=if(AgentVer==TA, "True","False")
| table Status

<!-- No good -->
<!-- Ok, maybe a subsearch will work -->

source=trellix AgentVer=*
[search source=trellix AgentVer=*
| stats max(AgentVer=*) AS TA
| table TA]
| eval Status=if(AgentVer=TAV, "True","False")
| table Status

<!-- No good -->

 

Again, the above are just examples of what I've tried. I've tried replacing | stats max(AgentVer) with | eval TA=max(AgentVer), I've tried chart instead of stats, and etc. I've even tried to just duplicate the field and use the duplicate instead of the original and still no luck. I've not found anything that can do what I'm trying to do. I hope it's possible but maybe I'm reaching here.  

Does the community have any recommendations for how to solve this? Thank you ahead of time!

Labels (6)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try eventstats so you don't lose the original events

source=trellix AgentVer=*
| eventstats max(AgentVer) AS TAV
| eval Status=if(AgentVer==TAV, "True","False")
| table Status

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try eventstats so you don't lose the original events

source=trellix AgentVer=*
| eventstats max(AgentVer) AS TAV
| eval Status=if(AgentVer==TAV, "True","False")
| table Status
0 Karma

BinaryAddict
Engager

@ITWhisperer , that's exactly what I was missing! I've been pounding my head against the wall for the past couple of hours... Thank you!

Here's the docs page for eventstats , for anyone having a similar issue. 

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...