topic Re: Alert when row count for two searches are not equal in Splunk Search

Alert when row count for two searches are not equal

seomaniv — Thu, 10 Dec 2020 00:23:18 GMT

I have two events: items received, and items acted on. I want to set an alert when the count by transactionID is not equal for the two searches. I have the search set up like so:

ok, it's a little more complicated, but this is the important part. So then need to compare itemsReceived to itemsProcessed to determine if there should be an alert. I have tried

... stats values(eval(itemsReceived-itemsProcessed)) as Difference ... | search Difference != 0

as well as doing the eval before the stats, but everything I try ends up with null values for the eval, even though the table is properly populated with the values for itemsReceived and itemsProcessed (I have also tried convert num(itemsReceived) and tonumber(itemsReceived,10) in the event Splunk was not recognizing these fields as numbers, but each time, the fields are null).

What am I doing wrong here?

Re: Alert when row count for two searches are not equal

richgalloway — Thu, 10 Dec 2020 01:35:28 GMT

The problem may be with the values(*) clause returning multi-field values, which most other functions can't handle. Try this alternative:

index=myIndex source=mySource | search criteriaForItemsReceived | eval state="Rcvd" | append [ search index-myIndex source=mySource | search criteriaForItemsProcessed | eval state="Proc" ] | stats count(eval(state="Rcvd")) as itemsReceived, count(eval(state="Proc")) as itemsProcessed by transactionID | eval Difference = itemsReceived - itemsProcessed

Re: Alert when row count for two searches are not equal

seomaniv — Thu, 17 Dec 2020 00:45:25 GMT

Thank you, Rich. Wasn't exactly my solution, but your post gave me my solution. What I ended up doing was:

| stats values(*) as * | eval Difference = itemsReceived - itemsProcessed | appendcols [stats values(Difference) as Difference by transactionID]

I wouldn't have come to that realization had it not been for your reply. Thank you!