Splunk Search

eval alerting on matching fields.

sbattista09
Contributor

i want to make an alert that will pop when two values in a event match.

index=foo_index  sourcetype=foofoo_prod| eval match=if(field1_foo==Filed2_foo,1,0)

The issues I am not sure of what eval function to use. 😞

0 Karma

saurabhkharkar
Path Finder

the if statement will return 1 if the fields match else it will return 0

| eval match=if(field1_foo==field2_foo,1,0)
| where match=1

If you want to set an alert - save the search where 'match=1' (to get events where the fields are same) as an alert where you can schedule it to run periodically or create a correlation search in Splunk ES to create a notable event.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...