Alerting

Alert based on comparison of two result rows

splunkrags
Engager

Hi Folks,

I am running a search query and I always have two sets of results.

Description              Rate

Transaction A            200
Transaction B            350

I need to trigger a conditional alert only if Rate of Transaction B is 50% more than Rate of Transaction A.

Any simple ways of achieving this ?

Thanks

1 Solution

dwaddle
SplunkTrust
SplunkTrust

You might be able to do this by feeding your results through | transpose followed by | where, something similar to this:

my search 
| transpose 
| search column=Rate 
| rename "row 1" TO  a 
| rename "row 2" TO b 
| where b > (a * 1.5)

And then alert on the return of any results.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

You might be able to do this by feeding your results through | transpose followed by | where, something similar to this:

my search 
| transpose 
| search column=Rate 
| rename "row 1" TO  a 
| rename "row 2" TO b 
| where b > (a * 1.5)

And then alert on the return of any results.

splunkrags
Engager

Thanks for the prompt reply! it works!

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...