Can a Splunk alert be triggered by comparing the row counts of two searches?

[jbrenner]

I would like to compare the row count returned from two searches and trigger an alert based on whether search 1 returns more rows than search 2. Is there a way to do this?

Thanks,
Jonathan

[aaraneta_splunk]

@jbrenner - Were you able to test out somesoni2's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

[somesoni2]

Yes, a simple implementation would be like this. More accurate/optimized suggestions if you can share your searches.

search1 | stats count as count1| appendcols [search search2 | stats count as count2] | where count1>count2