I would like to create an alert if the number on events is different in two subsearches.
subsearch1 = "index=index1 | dedup checksum | stats count"
subsearch2 = "index=index2 | dedup checksum | stats count"
unsuccessful attempts: 1) using subsearch
index=index1 | dedup checksum | stats count | search count > [search index=index2 | dedup checksum |stats count | search count]
2) using set diff
set diff [search index=index1 | dedup checksum] [search index=index2 | dedup checksum]
index=index1 OR index=index2 | dedup index,checksum | stats count by index | eval nevents="nevents" | xyseries index nevents count | where index1!=index2
Update:
Actually now that I think about it, this may be clearer and more generally useful:
index=index1 OR index=index2 | dedup index,checksum | stats count(eval(index=="index1")) as index1count, count(eval(index=="index2")) as index2count | where index1count!=index2count
index=index1 OR index=index2 | dedup index,checksum | stats count by index | eval nevents="nevents" | xyseries index nevents count | where index1!=index2
Update:
Actually now that I think about it, this may be clearer and more generally useful:
index=index1 OR index=index2 | dedup index,checksum | stats count(eval(index=="index1")) as index1count, count(eval(index=="index2")) as index2count | where index1count!=index2count