https://community.splunk.com/t5/Splunk-Search/newb-help-creating-an-alert/m-p/42137#M9807 <P>Hi there,</P> <P>i'm somewhat new to splunk and hoping some of the more seasoned veterans can assist me.</P> <P>I have a process hashing a file and writing some output to a log.</P> <P>the entries look like this:</P> <P>Wed 11/21/201215:17:54.38 //// File Checksum Integrity Verifier version 2.05.//31127455faac11149dfdabc2261cdb7a c:\integrity\integrityservicex.exe<BR /> host=WIN-IK3D6F4B55R Options| sourcetype=integrity-too_small Options|<BR /><BR /> source=C:\Program Files\SplunkUniversalForwarder\integrity.txt Options</P> <P>it is being indexed and is searchable properly.</P> <P>what I wanted to to was create an alert for when the hash entry changes, in this case the hash is :31127455faac11149dfdabc2261cdb7a</P> <P>so I would always expect the valid entry to exist in the file, what I want to do is detect an invalid entry (the hash has changed) and alert based on that.</P> <P>Could anyone offer a few hints to get me started?</P> Wed, 21 Nov 2012 20:40:26 GMT plastiiq 2012-11-21T20:40:26Z https://community.splunk.com/t5/Splunk-Search/newb-help-creating-an-alert/m-p/42137#M9807 <P>Hi there,</P> <P>i'm somewhat new to splunk and hoping some of the more seasoned veterans can assist me.</P> <P>I have a process hashing a file and writing some output to a log.</P> <P>the entries look like this:</P> <P>Wed 11/21/201215:17:54.38 //// File Checksum Integrity Verifier version 2.05.//31127455faac11149dfdabc2261cdb7a c:\integrity\integrityservicex.exe<BR /> host=WIN-IK3D6F4B55R Options| sourcetype=integrity-too_small Options|<BR /><BR /> source=C:\Program Files\SplunkUniversalForwarder\integrity.txt Options</P> <P>it is being indexed and is searchable properly.</P> <P>what I wanted to to was create an alert for when the hash entry changes, in this case the hash is :31127455faac11149dfdabc2261cdb7a</P> <P>so I would always expect the valid entry to exist in the file, what I want to do is detect an invalid entry (the hash has changed) and alert based on that.</P> <P>Could anyone offer a few hints to get me started?</P> Wed, 21 Nov 2012 20:40:26 GMT https://community.splunk.com/t5/Splunk-Search/newb-help-creating-an-alert/m-p/42137#M9807 plastiiq 2012-11-21T20:40:26Z https://community.splunk.com/t5/Splunk-Search/newb-help-creating-an-alert/m-p/42138#M9808 <P>A method will be to use a field extraction to get the value of the hash from each event.<BR /> Then pick a timerange and get the first and last hash of the events and add some logic.<BR /> Finally setup an alert on the number of results &gt; 0</P> <P><CODE>&lt;mysearch&gt; <BR /> | rex "version \d+\.\d+.(|\d+)//(?&lt;hash&gt;[\w\d]*)" <BR /> | stats latest(_time) as _time latest(hash) AS newhash earliest(hash) AS oldhash <BR /> | WHERE NOT newhash=oldhash <BR /> | table _time newhash</CODE></P> Wed, 21 Nov 2012 20:59:44 GMT https://community.splunk.com/t5/Splunk-Search/newb-help-creating-an-alert/m-p/42138#M9808 yannK 2012-11-21T20:59:44Z