Reporting

Alert when the results of 2 searches do not match.

CaseyCarson
Engager

I have 2 different searches and I need to create an alert that would trigger if the results of the 2 searches are not equal. Below are my 2 searches. What we are doing is comparing a count of records in and count of records out to make sure the application did not have an issue processing.

index=omma source=omma
| bin _time span=5ms
| stats latest(liccount) as "Value" by lictype
| stats sum("Value") as "Total Records"

 

index=omma
| stats dc(record_id) as "Total Records"

Labels (1)
0 Karma
1 Solution

tscroggins
Builder

@CaseyCarson 

With minimal changes to your base searches:

index=omma source=omma
| bin _time span=5ms
| stats latest(liccount) as "Value" by lictype
| status sum("Value") as "Total Records In"
| appendcols
    [ search index=omma
    | stats dc(record_id) as "Total Records Out" ]
| where 'Total Records In'!='Total Records Out'

 

View solution in original post

0 Karma

tscroggins
Builder

@CaseyCarson 

With minimal changes to your base searches:

index=omma source=omma
| bin _time span=5ms
| stats latest(liccount) as "Value" by lictype
| status sum("Value") as "Total Records In"
| appendcols
    [ search index=omma
    | stats dc(record_id) as "Total Records Out" ]
| where 'Total Records In'!='Total Records Out'

 

View solution in original post

0 Karma

CaseyCarson
Engager

Thank you! This is what I needed!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!