Monitor the count of columns generated by solutionType=* | splunk reports

[harkirat9712]

I would like to track count of the all the below splunk search query columns. if any "solutionType" is appended or deleted I expect alert.

index=index1 | search solutionType=* | timechart count by solutionType | result below

column1 column2 column3 column4 column5

if column6 is added in next splunk report. or col5 is removed I expect alert.

if current_col_count != 5

I would like to track if any "solutionType" is appended or deleted in next splunk report expect alert.

[martin_mueller · Accepted solution]

This will give you the number of columns, set your alert to trigger when it's not five:

index=index1 solutionType=* | stats dc(solutionType) as current_col_count