Hi,
I am running an alert for every 15 mins and looking for a logic to stop subsequent splunk alerts if a field value remains the same during the next run of the alert. The next alert should trigger only if the field value changes
Appreciate if someone can help with the logic.
You can do several things. If you only need to compare two time periods ad see if there is a difference, you can use multisearch
. Something like this might work:
| multisearch
[ search <your-search-to-get-data> earliest=-30m@m latest=-15m@m
| eval type=first]
[ search <your-search-to-get-data> earliest=-15m@m latest=-0m@m
| eval type=next]
| stats values(<field-you-want-to-compare>) as val
| eval diff=if(mvindex(val,0)!=mvindex(val,1),1,0)
This can take any time periods that you want, for example, you can set it to the same time on the previous day to be compared with the value today, so it is general in nature. Just set the earliest
and latest
times appropriately. The stats
command makes a multivalue field that can then be used with the eval. The mvindex
function let's you grab the two values that you get and set the difference in the field diff
. If the value of diff
is 1, then they are different, and if 0, then the same. This is a very generalized way to handle doing this. There are many ways to make it more efficient or effective.
You don't really need the eval type="first"
or eval type="last"
. It just makes it possible to see the values separately. Don't worry about getting hung up on what it does, because in this case it doesn't really do anything, but it could be useful in some circumstances.
You can do several things. If you only need to compare two time periods ad see if there is a difference, you can use multisearch
. Something like this might work:
| multisearch
[ search <your-search-to-get-data> earliest=-30m@m latest=-15m@m
| eval type=first]
[ search <your-search-to-get-data> earliest=-15m@m latest=-0m@m
| eval type=next]
| stats values(<field-you-want-to-compare>) as val
| eval diff=if(mvindex(val,0)!=mvindex(val,1),1,0)
This can take any time periods that you want, for example, you can set it to the same time on the previous day to be compared with the value today, so it is general in nature. Just set the earliest
and latest
times appropriately. The stats
command makes a multivalue field that can then be used with the eval. The mvindex
function let's you grab the two values that you get and set the difference in the field diff
. If the value of diff
is 1, then they are different, and if 0, then the same. This is a very generalized way to handle doing this. There are many ways to make it more efficient or effective.
You don't really need the eval type="first"
or eval type="last"
. It just makes it possible to see the values separately. Don't worry about getting hung up on what it does, because in this case it doesn't really do anything, but it could be useful in some circumstances.