Help on how to track changes through diffrent indexations.

[ZohanDvir]

Hello,
How can i make an alert that alerts me on changes in my event.
for example:
I index every so often a csv with the fields: item_id, item_description
I want to get an alert every time an item is removed from the indexed csv or is added to it.

if at first I index:
item_id, item_description
1,box

and after that I index:
item_id, item_description
2,chair

I want to get an alert on the removed box AND on the new chair.

I really don't know when to start and would really appreciate any input.

[somesoni2]

Let's assume you upload/index your csv every 15 mins, so what you need to do is compare the content of csv file indexed 30 min back with what you've ingested 15 min back and see what are addition/deletion. So, something like this should do the task.

index=foo sourcetype=bar earliest=-30m@m latest=@m | eval Update=if(_time<relative_time(now(),"-15m@m"),"Deleted","Added") | stats values(Update) as Update by item_id, item_description | where mvcount(Update)=1