Alerting

Alert based on comparison of two result rows

splunkrags
Engager

Hi Folks,

I am running a search query and I always have two sets of results.

Description              Rate

Transaction A            200
Transaction B            350

I need to trigger a conditional alert only if Rate of Transaction B is 50% more than Rate of Transaction A.

Any simple ways of achieving this ?

Thanks

1 Solution

dwaddle
SplunkTrust
SplunkTrust

You might be able to do this by feeding your results through | transpose followed by | where, something similar to this:

my search 
| transpose 
| search column=Rate 
| rename "row 1" TO  a 
| rename "row 2" TO b 
| where b > (a * 1.5)

And then alert on the return of any results.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

You might be able to do this by feeding your results through | transpose followed by | where, something similar to this:

my search 
| transpose 
| search column=Rate 
| rename "row 1" TO  a 
| rename "row 2" TO b 
| where b > (a * 1.5)

And then alert on the return of any results.

splunkrags
Engager

Thanks for the prompt reply! it works!

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...