https://community.splunk.com/t5/Splunk-Search/How-to-Compare-two-fields-from-one-search-with-alerting-and/m-p/655023#M226276 <DIV class="">Looks plausible. I ll test it, and get feedback to you in a month !</DIV> Mon, 21 Aug 2023 12:08:01 GMT CMEOGNAD 2023-08-21T12:08:01Z https://community.splunk.com/t5/Splunk-Search/How-to-Compare-two-fields-from-one-search-with-alerting-and/m-p/655002#M226269 <P>Hello Community,</P> <P>i get all 24h a version REST call.<BR />How to get a alert mail with the new version (like 2023-09) as text in the message body, when a new different version appears like...<BR />Line 1: 2023-09<BR />Line 2: 2023-08<BR /><BR />index="my_index" source="/var/log/my_version"<BR />| head 2<BR />| spath version<BR /><BR /></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="CMEOGNAD_0-1692608641928.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/26908i74DBF37F8A2C768A/image-size/medium?v=v2&amp;px=400" role="button" title="CMEOGNAD_0-1692608641928.png" alt="CMEOGNAD_0-1692608641928.png" /></span></P> <P>Regards - Markus</P> <P>&nbsp;</P> <P><BR /><BR /></P> Mon, 21 Aug 2023 19:48:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Compare-two-fields-from-one-search-with-alerting-and/m-p/655002#M226269 CMEOGNAD 2023-08-21T19:48:57Z https://community.splunk.com/t5/Splunk-Search/How-to-Compare-two-fields-from-one-search-with-alerting-and/m-p/655009#M226271 <LI-CODE lang="markup">index="my_index" source="/var/log/my_version" | head 2 | spath version | streamstats current=f window=2 last(version) as previous_version | where version != previous_version</LI-CODE> Mon, 21 Aug 2023 10:10:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Compare-two-fields-from-one-search-with-alerting-and/m-p/655009#M226271 ITWhisperer 2023-08-21T10:10:15Z https://community.splunk.com/t5/Splunk-Search/How-to-Compare-two-fields-from-one-search-with-alerting-and/m-p/655023#M226276 <DIV class="">Looks plausible. I ll test it, and get feedback to you in a month !</DIV> Mon, 21 Aug 2023 12:08:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Compare-two-fields-from-one-search-with-alerting-and/m-p/655023#M226276 CMEOGNAD 2023-08-21T12:08:01Z