Query which should show whenever there is a modification in data set

[Janani_Krish]

Hello All,

I have to construct a query whenever there is change in my query result. My query and result is as follows,
Query:
sourcetype="my_sourcetype"|dedup indicator|table indicator

Result:
indicator

a

b

So I need to get an alert whenever my set [Indicator(a,b)] changes, i.e addition [indicator(a,b,c)] or deletion[indicator(a)] happens.
Please suggest for my above requirement.

[richgalloway]

If you only need to worry about additions or deletions then this query should do.

sourcetype="my_sourcetype"
| stats dc(indicator) as count
| where count != 2

Trigger an alert whenever the query returns results.

[Janani_Krish]

Thanks @richgalloway 
That will help. But is there any way I can identify any modifications in the list, like Indicator[a.b] changed to Indicator[c,d].

[richgalloway]

First, you'll need to save the set of expected results.

sourcetype="my_sourcetype"
|dedup indicator
|table indicator
| outputlookup indicator.csv

Then you can compare those results to a new search.

| set diff [sourcetype="my_sourcetype"|dedup indicator|table indicator]
[|inputlookup indicator.csv]