I would like to track count of the all the below splunk search query columns. if any "solutionType" is appended or deleted I expect alert.
index=index1 | search solutionType=* | timechart count by solutionType | result below
column1 column2 column3 column4 column5
if column6 is added in next splunk report. or col5 is removed I expect alert.
if current_col_count != 5
I would like to track if any "solutionType" is appended or deleted in next splunk report expect alert.
This will give you the number of columns, set your alert to trigger when it's not five:
index=index1 solutionType=* | stats dc(solutionType) as current_col_count
This will give you the number of columns, set your alert to trigger when it's not five:
index=index1 solutionType=* | stats dc(solutionType) as current_col_count