https://community.splunk.com/t5/Splunk-Search/How-to-print-a-change-in-value/m-p/486527#M136079 <P>Hi tech_soul,<BR /> could you share more information about your data?<BR /> especially if the value to check is continously logged or it appears only one time in a period.</P> <P>Anyway, I suppose that the value to check is continously logged, try something like this:</P> <PRE><CODE>index=my_index earliest=-5m latest=now | stats dc(check_field) AS check | where check=1 </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Fri, 27 Sep 2019 08:21:11 GMT gcusello 2019-09-27T08:21:11Z https://community.splunk.com/t5/Splunk-Search/How-to-print-a-change-in-value/m-p/486526#M136078 <P>Hi all,<BR /> Please help me to set an alert when a value change occurred.<BR /> Also, I need to print old and new values.</P> Fri, 27 Sep 2019 06:04:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-print-a-change-in-value/m-p/486526#M136078 tech_soul 2019-09-27T06:04:09Z https://community.splunk.com/t5/Splunk-Search/How-to-print-a-change-in-value/m-p/486527#M136079 <P>Hi tech_soul,<BR /> could you share more information about your data?<BR /> especially if the value to check is continously logged or it appears only one time in a period.</P> <P>Anyway, I suppose that the value to check is continously logged, try something like this:</P> <PRE><CODE>index=my_index earliest=-5m latest=now | stats dc(check_field) AS check | where check=1 </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Fri, 27 Sep 2019 08:21:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-print-a-change-in-value/m-p/486527#M136079 gcusello 2019-09-27T08:21:11Z