Splunk Search

How can I show the difference in a string field from one day to another?

bscavotto
New Member

I have a powershell script that audits some files and creates an Windows application event log with the filepaths of any matches in the Message field. It runs once per day and creates a single event log everyday. I only want the diff from one day to the next as new things are found.

My query so far only gives me the split listing of the Message field contents and the count but how do I get it to only show me the new entries as compared to the previous day?

sourcetype=WinEventLog:Application SourceName=MessageAudit |eval NewMessage=split(Message,"\\\\") |eval NewMessageCount=mvcount(NewMessage) |table NewMessage,NewMessageCount | search NewMessageCount>36
(There are 36 consistent false positives)

Thanks.

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this

sourcetype=WinEventLog:Application SourceName=MessageAudit earliest=-1d@d latest=now
| fields _time Message |eval Message=split(Message,"\\\\") | mvexpand Message
| stats values(_time) as time by Message 
| rename COMMENT as "Below line will filter results to show new paths that were received today"
| whhere mvcount(time)=1 AND time>=relative_time(now(),"@d")

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

sourcetype=WinEventLog:Application SourceName=MessageAudit earliest=-1d@d latest=now
| fields _time Message |eval Message=split(Message,"\\\\") | mvexpand Message
| stats values(_time) as time by Message 
| rename COMMENT as "Below line will filter results to show new paths that were received today"
| whhere mvcount(time)=1 AND time>=relative_time(now(),"@d")
0 Karma

bscavotto
New Member

Thanks, I appreciate the help.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Perhaps the diff command would work here

sourcetype=WinEventLog:Application SourceName=MessageAudit |eval NewMessage=split(Message,"\\\\") |eval NewMessageCount=mvcount(NewMessage) |table NewMessage,NewMessageCount| diff pos1=... pos2=... | search NewMessageCount>36

https://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/Diff

0 Karma

bscavotto
New Member

Thanks, I've reviewed that document. I'm not clear on what would go into the pos1 and pos2 fields.

0 Karma

bscavotto
New Member

Plus, I'm not diffing data in the same output. This is output from each day separately.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...