Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to compare when a field value changes from current to previous?

$
0
0
I am looking to find events where IP address changes from previous to current, however using fist(ip) and last(ip) misses the events in between the first and last... Ideally I am looking to find when a change occurs for the IP value and then look at the previous IP value... this comparison is then used to find ip geoloc and calc the speed = dist/time with haversine app. Thank you

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>