How to create an alert based on first occurrence of a field value

[tdavison76]

Hello,

My apologies, I hope this makes sense, still learning.  I have events coming in that look like this:

I need to create an alert for when state = 1 for name = VZEROP002.  But, I can't figure out how to write the query to only look at the state for VZEROP002. 

The query I'm running is:

index=zn | spath "items{1}.state" | search "items{1}.state"=1

But, the search results still return events where VZEROP002 has a state of 2, and VZEROP001 has the state of 1.

I hope that makes sense, and thanks in advance for any help with this.

Thanks,

Tom

[PaulPanther · Accepted solution]

Good Morning! Is the order for the name always the same? So that VZEROP002 is always the first entry in the list?

If yes you could try:

index=zn| spath "items{0}.state" | spath "items{0}.name"| search "items{0}.name"=VZEROP002 "items{0}.state"=1

Do you need the list entries in one event for comparison within the event or could you split them in separate events?

[tdavison76]

Hello,

Thank you for your help, that did t he trick.  Unfortunately, the only option I see is to bring them in as a list.  It appears VZEROP002 is always the first on the list.  So this should do the trick.

Thanks again,

Tom