How to create an alert when a field value changes?

[evallja]

Hello everyone,

I have the below search:

index=flexcube
[|inputlookup AUTHs.csv
| fields + role_id ]
[|inputlookup function_ids.csv
| rename C_FUNCTION_ID as role_function
| fields + role_function]
| rename role_function as function_id
| chart latest(control_1) as NEW, latest(control_8) as AUTH over function_id by role_id limit=0

and it returns the following table:

function_id              AUTH: A      AUTH: B       AUTH: C      AUTH: D
1 ACDCBIRD                                         0                     1
2 CADAMBLK               1                                                                     0
3 CLDACAUT                1                      0                      0                    0
4 CLDACCNT                0                        1                  1                        1              ...etc.

I want to create an alert that catches only when a value changes from blank to 0 or 1, or vice versa.

Thanks in advance.

[gcusello]

Hi, please try this:

index=flexcube [|inputlookup AUTHs.csv | fields + role_id ] [|inputlookup function_ids.csv
| rename C_FUNCTION_ID AS function_id
| stats 
   dc(control_1) AS control_1_count 
   dc(control_8) AS control_8_count
   values(control_1) AS control_1 
   values(control_8) AS control_8
   BY function_id role_id
| where control_1_count>1 OR control_8_count>1

Ciao.

Giuseppe

[ITWhisperer]

You could try something like this

| fillnull value="Create alert"
| search "Create alert"