https://community.splunk.com/t5/Alerting/Custom-Trigger-Alert-When-New-Field-is-Created/m-p/582001#M13405 <P>If we're only interested in yesterday and today then there's no need to look back 30 days.&nbsp; We'll look at two days, find the difference between them, and trigger an alert if there is one.</P><LI-CODE lang="markup">| inputlookup program_version.csv | where date&gt;=relative_time(now(), "-1d@d") | eval _time=date | timechart max(count) as count by version | eventstats range(count) as diff | where diff!=0</LI-CODE> Fri, 21 Jan 2022 13:48:18 GMT richgalloway 2022-01-21T13:48:18Z https://community.splunk.com/t5/Alerting/Custom-Trigger-Alert-When-New-Field-is-Created/m-p/581928#M13404 <P>Hello!&nbsp;</P><P>I need help created a custom triggered alert condition where when I run the search below it will send me an alert when there is a new version created compared to the versions that were listed yesterday. So the trigger alert would run once each day and if I had 1.1.1 and 1.1.2 the day before but yesterday I had it give me results with 1.1.1, 1.1.2, 1.1.3 then to send me an alert when that new version is detected. How would I go about setting up that custom alert?</P><P>&nbsp;</P><P>| inputlookup program_version.csv<BR />| where date&gt;=relative_time(now(), "-30d@d")<BR />| eval _time=date<BR />| timechart max(count) by version</P> Thu, 20 Jan 2022 19:05:29 GMT https://community.splunk.com/t5/Alerting/Custom-Trigger-Alert-When-New-Field-is-Created/m-p/581928#M13404 MikeB 2022-01-20T19:05:29Z https://community.splunk.com/t5/Alerting/Custom-Trigger-Alert-When-New-Field-is-Created/m-p/582001#M13405 <P>If we're only interested in yesterday and today then there's no need to look back 30 days.&nbsp; We'll look at two days, find the difference between them, and trigger an alert if there is one.</P><LI-CODE lang="markup">| inputlookup program_version.csv | where date&gt;=relative_time(now(), "-1d@d") | eval _time=date | timechart max(count) as count by version | eventstats range(count) as diff | where diff!=0</LI-CODE> Fri, 21 Jan 2022 13:48:18 GMT https://community.splunk.com/t5/Alerting/Custom-Trigger-Alert-When-New-Field-is-Created/m-p/582001#M13405 richgalloway 2022-01-21T13:48:18Z