I want to alert if a result changes. There are probably dozens of ways to do this, but I think I'm missing the really simple obvious solution. I've been looking at diff, and I can get this to work in search results - providing a single "event" result containing either "Results are the same" or some stats if a difference is found. The expression looks like this:
index=testapp ErrorlogTotalCount |diff
I could add an attribute, but it's not really needed because the result is static except for the log count. The default position values of 1 and 2, comparing the newest result to the prior one, is also perfect because we want to catch when the number changes. My difficulty is setting up an alert to catch this. Since I always get 1 event back, I can't alert on a count of events. Maybe I can use a custom trigger condition, but I'm not finding a document that explains how to use that field.
This is probably possible with other search commands such as delta or streamstats but to me those appear to be overkill. Let me know what I am missing please. Thanks for the help.
