Splunk Subsequent Alert

[chintu_jain]

Hi,

I am running an alert for every 15 mins and looking for a logic to stop subsequent splunk alerts if a field value remains the same during the next run of the alert. The next alert should trigger only if the field value changes

Appreciate if someone can help with the logic.

[cpetterborg · Accepted solution]

You can do several things. If you only need to compare two time periods ad see if there is a difference, you can use multisearch. Something like this might work:

| multisearch 
    [ search <your-search-to-get-data> earliest=-30m@m latest=-15m@m
    | eval type=first] 
    [ search <your-search-to-get-data> earliest=-15m@m latest=-0m@m
    | eval type=next]
| stats values(<field-you-want-to-compare>) as val
| eval diff=if(mvindex(val,0)!=mvindex(val,1),1,0)

This can take any time periods that you want, for example, you can set it to the same time on the previous day to be compared with the value today, so it is general in nature. Just set the earliest and latest times appropriately. The stats command makes a multivalue field that can then be used with the eval. The mvindex function let's you grab the two values that you get and set the difference in the field diff. If the value of diff is 1, then they are different, and if 0, then the same. This is a very generalized way to handle doing this. There are many ways to make it more efficient or effective.

You don't really need the eval type="first" or eval type="last". It just makes it possible to see the values separately. Don't worry about getting hung up on what it does, because in this case it doesn't really do anything, but it could be useful in some circumstances.