Hello everyone,
I have the below search:
index=flexcube
[|inputlookup AUTHs.csv
| fields + role_id ]
[|inputlookup function_ids.csv
| rename C_FUNCTION_ID as role_function
| fields + role_function]
| rename role_function as function_id
| chart latest(control_1) as NEW, latest(control_8) as AUTH over function_id by role_id limit=0
and it returns the following table:
function_id AUTH: A AUTH: B AUTH: C AUTH: D
1 ACDCBIRD 0 1
2 CADAMBLK 1 0
3 CLDACAUT 1 0 0 0
4 CLDACCNT 0 1 1 1 ...etc.
I want to create an alert that catches only when a value changes from blank to 0 or 1, or vice versa.
Thanks in advance.
Hi, please try this:
index=flexcube [|inputlookup AUTHs.csv | fields + role_id ] [|inputlookup function_ids.csv
| rename C_FUNCTION_ID AS function_id
| stats
dc(control_1) AS control_1_count
dc(control_8) AS control_8_count
values(control_1) AS control_1
values(control_8) AS control_8
BY function_id role_id
| where control_1_count>1 OR control_8_count>1
Ciao.
Giuseppe
You could try something like this
| fillnull value="Create alert"
| search "Create alert"