Alerting

Splunk alert when search result changes over last 5 minutes

rakes568
Explorer

I have data like this:

Item1 Item2 Status

A B On
C D Off

Now I want to generate an email alert if this search result changes over last 5 minutes. For example:
1. If status of any two items already present in search result changes, generate an alert.
2. If a new row gets added, generate an alert.
3. If a rwo gets deleted, generate an alert.

Tags (2)
0 Karma

oda
Communicator

Save the result 5 minutes ago in the lookup file and use the diff command.
Is it the desired behavior?
https://docs.splunk.com/Documentation/Splunk/6.6.1/SearchReference/Diff

0 Karma

Richfez
SplunkTrust
SplunkTrust

Do these events have proper timestamps? Are they from a DB? Can you paste one or two of the actual events?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...