monitor change of a particular field

[spyme72]

i want to monitor a field called state which can have 2 values , stopped and running.
i want to alert when ever the state changes from running to stopped or from stopped to running.

Event:
Caption=WWAN AutoConfig
DisplayName=WWAN AutoConfig
Name=WwanSvc
ProcessId=0
StartName=NT Authority\LocalService
State=Stopped
Status=OK
SystemName=R9R8CF1
wmi_type=Services

[alacercogitatus · Accepted solution]

Maintaining state is greatly described here: http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/. The best way to keep track is with lookups. If you run a search every 5 minutes, dedup will only know of state changes within that time range, and no longer, and running dedup over large datasets can become memory intensive. Read the article, and then repost with some specific questions if you have them.

[lukejadamec]

What answer 🙂

[alacercogitatus]

But in your answer, you specify that you are running a search every 5 minutes, which dedup will only look within whatever time range you pick. Dedup is especially more expensive a search, as it requires the events to be returned to the searchhead before throwing them away.