https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-to-trigger-if-the-value-stored-in-a-CSV/m-p/130020#M35380 <P>Saved search:</P> <PRE><CODE> sourcetype=* | timechart last(Cnt) as CurrentQueueLength span=5m | Where CurrentQueueLength&gt;0 | table CurrentQueueLength | outputcsv ABC </CODE></PRE> <P>CSV:<BR /> CurrentQueueLength<BR /> 15</P> <P>If the value increases by 5 (Value to be taken from CSV file), I need to trigger an alert ( cond=CurrentQueueLength+5).</P> Mon, 20 Jul 2015 10:48:59 GMT manja054 2015-07-20T10:48:59Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-to-trigger-if-the-value-stored-in-a-CSV/m-p/130020#M35380 <P>Saved search:</P> <PRE><CODE> sourcetype=* | timechart last(Cnt) as CurrentQueueLength span=5m | Where CurrentQueueLength&gt;0 | table CurrentQueueLength | outputcsv ABC </CODE></PRE> <P>CSV:<BR /> CurrentQueueLength<BR /> 15</P> <P>If the value increases by 5 (Value to be taken from CSV file), I need to trigger an alert ( cond=CurrentQueueLength+5).</P> Mon, 20 Jul 2015 10:48:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-to-trigger-if-the-value-stored-in-a-CSV/m-p/130020#M35380 manja054 2015-07-20T10:48:59Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-to-trigger-if-the-value-stored-in-a-CSV/m-p/130021#M35381 <P>I don't get your search: it could return more than 1 value or no values! You should probably do something like this:</P> <PRE><CODE>earliest=-5m@m sourcetype=* | stats latest(Cnt) as CurrentQueueLength | outputcsv ABC </CODE></PRE> <P>Then schedule the following search as an alert that triggers when "# events &gt; 0" and runs 1 minute before the first one runs (just before the value is overwritten):</P> <PRE><CODE>earliest=-5m@m sourcetype=* | stats latest(Cnt) as CurrentQueueLength | append [|inputcsv ABC | rename CurrentQueueLength AS PrevQueueLength] | eval delta = CurrentQueueLength - PrevQueueLength | where delta &gt; 5 </CODE></PRE> <P>Also, you might consider using <CODE>avg</CODE> but definitely don't use <CODE>last</CODE> because it does the opposite of what you think it does (earliest value), which is why I switched it to <CODE>latest</CODE>.</P> Mon, 20 Jul 2015 14:18:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-to-trigger-if-the-value-stored-in-a-CSV/m-p/130021#M35381 woodcock 2015-07-20T14:18:09Z