Send alerts if only latest search result is different from previous searched results

[wailoont]

Hi,

I have a search query below :

sourcetype="XXX"  earliest=-1w@w latest=now | rex field=_raw "(?msi)(?<user_login>\{.+\}$)" | spath input=user_login 
| rex field=repo_name "^(?<repo_name>[^/]+)" | spath input=repo_name 
| stats  values(repo_name) as REPO_LIST dc(repo_name) AS DISTINCT_REPO by user_login | where  DISTINCT_REPO > 4  | sort  by DISTINCT_REPO desc

This query will generate results and send alert emails to admins if there is a result. However, we want to monitor this everyday, but we prefer to get alerts if the results for each alert are different. Currently, the results is same everyday. How to configure it to send alerts if only the results is different from previous sent alert ?

[woodcock]

You need to dump the alert details (including _time = now() into a lookup with outputlookup and then only alert if that alert is the latest one in the lookup. You will also need to purge events in the lookup that are older than 24-hours old.

[skoelpin]

This is a good use case for a summary index. All alert data should get sent to the summary index, you than create an alert over the summary index (Way faster too) which then compares the current result over the previous result

[wailoont]

Hi skoelpin,

Do you have any examples of using a summary index? Sorry i am new to Splunking. 🙂

Thanks.

[vishaltaneja070]

Hello @wailoont

The best approach I can think of is a lookup in this. You have to create two searches.
1. One which will add the result to lookup table.
2. To compare result with lookup table.

[skoelpin]

Lookups won't scale well overtime. You'd have to have a process to add and purge old data or else the lookup will get too large and be unusable