https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171824#M49250 <P>Sorry about that. Added it in.</P> Mon, 09 Mar 2015 23:14:58 GMT KindaWorking 2015-03-09T23:14:58Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171820#M49246 <P>I have a table that shows something like this:</P> <PRE><CODE>Site X V 1.1 V 1.2 V 1.3 Site Y V 1.3 Site Z V 1.2 </CODE></PRE> <P>I want an alert to show me when a site has multiple versions. I cannot not quite get my search correct.</P> <P>The search I am currently using:</P> <PRE><CODE>| dbquery "SQLDB" "SELECT * FROM TABLE WHERE StatusType="Version" ORDER BY SITES"|Stats values(StatusValue) by SITES </CODE></PRE> Mon, 09 Mar 2015 21:17:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171820#M49246 KindaWorking 2015-03-09T21:17:54Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171821#M49247 <P>Hi @KindaWorking</P> <P>Can you share the actual search you're using so users can see how you're generating your current results and how they can edit it to help you? </P> Mon, 09 Mar 2015 21:36:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171821#M49247 ppablo 2015-03-09T21:36:06Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171822#M49248 <P>Assuming the table above you have the columns: siteName and siteVersion, and assuming the siteVersion is a multi-value field you could use the function <CODE>mvcount</CODE>. Something like that:</P> <PRE><CODE>... &lt;YOUR SEARCH&gt; | where mvcount(siteVersion) &gt; 1 </CODE></PRE> <P>That would list only sites with multiple versions, so you could setup your alert based on that.</P> <P>ps.: I've assumed lots of things as there was no much information provided.</P> Mon, 09 Mar 2015 22:29:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171822#M49248 musskopf 2015-03-09T22:29:53Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171823#M49249 <P>Sorry about being so vague. I have updated my question to include the search string I am using. I am going to try to incorporate the mcvount into my search and see how I go.</P> Mon, 09 Mar 2015 23:11:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171823#M49249 KindaWorking 2015-03-09T23:11:38Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171824#M49250 <P>Sorry about that. Added it in.</P> Mon, 09 Mar 2015 23:14:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171824#M49250 KindaWorking 2015-03-09T23:14:58Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171825#M49251 <P>It should work, as the <CODE>values</CODE> function you're using will produce a multi-value field. I would only suggest to rename it, like:</P> <PRE><CODE>... | stats values(StatusValue) AS siteVersion by SITES | where mvcount(siteVersion) &gt; 1 </CODE></PRE> Mon, 09 Mar 2015 23:19:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171825#M49251 musskopf 2015-03-09T23:19:41Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171826#M49252 <P>You are my hero!<BR /> That works perfectly.</P> Mon, 09 Mar 2015 23:28:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-an-alert-to-trigger-when-a-site-has-multiple/m-p/171826#M49252 KindaWorking 2015-03-09T23:28:50Z