Splunk Search

Validate changes through SPL


Hi, We are going to deploy changes which will delete certain package from instance. We want to know whether this package is getting deleted after the changes goes through. We are capturing this data in Splunk. 

So Let's say we have package=abc We can find if package exist using following SPL:



index=osstats sourcetype=package "abc"
| bin _time span=1d 
| multikv fields NAME 
| eval package_exist=if(like(NAME,"abc%"),1,0) 
| eval package_name=if(like(NAME,"abc%"),NAME,NULL) 
| stats count by _time host package_exist package_name



Following index is polling data hourly therefore if search for last 24 hours, it will report count=24, host=abc.com,package_exist=1, package_name=abc

Now I have created lookup table from this for last 1 year worth of data. 

What i want to know is, suppose I have host (doesn't have to be part of above query), I want to check if it had package earlier and now it is getting removed. 

I am not sure how I can go above doing that. 

Labels (2)


Assuming your index has been populated every hour for the past year, your query appears to get the daily count of the number of hours each abc package existed on each host.  The package doesn't have to exist on the host now. Why isn't what you already have sufficient?


Because I am filtering with "abc". So technically package exist is rhetorical as it always gonna give 1 

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...