Splunk Search

How to alert when a certain field changes from a value to another random value?

clairebesson
Explorer

Hi everyone,

I want to create an alert by email when one of the fields of my index changes. I have a file with different counters with values associated (one column for the counters name and one column for the value).

I would like to be notified by email when the value of one specific counter changes.
I’ve read the documentation about real time alert, but I didn’t find anything that could help me.
Example: Let's say that I am interested in the "counter_1". If the value of counter_1 change I would like to be alerted.

Could you help me with that issue?
Thanks!

0 Karma

woodcock
Esteemed Legend

Setup a search to run every X minutes and over the last X+1 minutes (where X is the same number) and search this:

... | stats dc(counter_1) AS numValues | search numValues>1
0 Karma

sundareshr
Legend

Please share couple of events. Have you extracted these columns as KV pairs? That will have to be your first step. https://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf

Once you have fields extracted, you can do a search with earliest=-5m, this will alert you of any changes in the past 5 mins. Since this is an extracted field, real-time search may not work correctly.

0 Karma

JDukeSplunk
Builder

If I read you right, then counter_1 is always X. So, setup the alert to exclude expected results, like X. But if counter_1=Y, the search will return a result, and you can alert on that. So...

 basesearch NOT counter_1=expectedvalue

And then setup the alert to run at whatever interval, and alert if number of results is greater than one?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...