https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-generate-an-alert-based-on-new-database-table-entry/m-p/345603#M41755 <P>Hi thanks!</P> <P>Actually I found more to this, so there is a different column I need to base this on "create_date". So I think you are on the right track so something like this:<BR /> index=main sourcetype=trims_tblXUsersRoles_audit xcomp_access_role_id=3 create_date="" | stats values(user_id) as userID by Action_date,Action,xcomp_access_role_id,create_login,create_date</P> <P>What can I do with the "create_date" to pickup the newest creation date when this job runs every 5mins?</P> Tue, 29 Sep 2020 13:11:01 GMT cjs1031 2020-09-29T13:11:01Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-generate-an-alert-based-on-new-database-table-entry/m-p/345601#M41753 <P>I am new to Splunk, very green. I have a DB search that I need to run and I have the search string I need but when I setup an alert, the alert is checking the results and sending them all to me. Basically, each time a new entry hits that table I need it to send me an email with just the new entrie(s). I imagine this is very simple to do but again, I am green. Here is my string.</P> <PRE><CODE>index=main sourcetype=trims_tblXUsersRoles_audit xcomp_access_role_id=3 | stats values(user_id) as userID by Action_date,Action,xcomp_access_role_id,create_login </CODE></PRE> Fri, 10 Mar 2017 18:59:25 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-generate-an-alert-based-on-new-database-table-entry/m-p/345601#M41753 cjs1031 2017-03-10T18:59:25Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-generate-an-alert-based-on-new-database-table-entry/m-p/345602#M41754 <P>Trying specifying a timerange either in your query syntax, then schedule the search to run every hour:</P> <P>e.g. <BR /> index=main sourcetype=trims_tblXUsersRoles_audit xcomp_access_role_id=3 <STRONG>earliest=-1h latest=now</STRONG> | stats values(user_id) as userID by Action_date,Action,xcomp_access_role_id,create_login</P> <P>In configuration, set the alert to email when there are greater than 0 events.</P> Tue, 29 Sep 2020 13:10:56 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-generate-an-alert-based-on-new-database-table-entry/m-p/345602#M41754 the_wolverine 2020-09-29T13:10:56Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-generate-an-alert-based-on-new-database-table-entry/m-p/345603#M41755 <P>Hi thanks!</P> <P>Actually I found more to this, so there is a different column I need to base this on "create_date". So I think you are on the right track so something like this:<BR /> index=main sourcetype=trims_tblXUsersRoles_audit xcomp_access_role_id=3 create_date="" | stats values(user_id) as userID by Action_date,Action,xcomp_access_role_id,create_login,create_date</P> <P>What can I do with the "create_date" to pickup the newest creation date when this job runs every 5mins?</P> Tue, 29 Sep 2020 13:11:01 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-generate-an-alert-based-on-new-database-table-entry/m-p/345603#M41755 cjs1031 2020-09-29T13:11:01Z