Splunk Search

Alert when row count for two searches are not equal

seomaniv
Explorer

I have two events: items received, and items acted on. I want to set an alert when the count by transactionID is not equal for the two searches. I have the search set up like so:

 

index=myIndex source=mySource 
| search criteriaForItemsReceived
| stats count as itemsReceived by transactionID
| append
    [ search index-myIndex source=mySource
    | search criteriaForItemsProcessed
    | stats count as itemsProcessed by transactionID ]
| stats values(*) as * by transactionID

 

ok, it's a little more complicated, but this is the important part. So then need to compare itemsReceived to itemsProcessed to determine if there should be an alert. I have tried

 

... stats values(eval(itemsReceived-itemsProcessed)) as Difference ...
| search Difference != 0

 

as well as doing the eval before the stats, but everything I try ends up with null values for the eval, even though the table is properly populated with the values for itemsReceived and itemsProcessed (I have also tried convert num(itemsReceived) and tonumber(itemsReceived,10) in the event Splunk was not recognizing these fields as numbers, but each time, the fields are null).

What am I doing wrong here?

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The problem may be with the values(*) clause returning multi-field values, which most other functions can't handle.  Try this alternative:

 

index=myIndex source=mySource 
| search criteriaForItemsReceived
| eval state="Rcvd"
| append
    [ search index-myIndex source=mySource
    | search criteriaForItemsProcessed
    | eval state="Proc" ]
| stats count(eval(state="Rcvd")) as itemsReceived, count(eval(state="Proc")) as itemsProcessed by transactionID
| eval Difference = itemsReceived - itemsProcessed 
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The problem may be with the values(*) clause returning multi-field values, which most other functions can't handle.  Try this alternative:

 

index=myIndex source=mySource 
| search criteriaForItemsReceived
| eval state="Rcvd"
| append
    [ search index-myIndex source=mySource
    | search criteriaForItemsProcessed
    | eval state="Proc" ]
| stats count(eval(state="Rcvd")) as itemsReceived, count(eval(state="Proc")) as itemsProcessed by transactionID
| eval Difference = itemsReceived - itemsProcessed 
---
If this reply helps you, Karma would be appreciated.

seomaniv
Explorer

Thank you, Rich. Wasn't exactly my solution, but your post gave me my solution. What I ended up doing was:

 

| stats values(*) as *
| eval Difference = itemsReceived - itemsProcessed
| appendcols [stats values(Difference) as Difference by transactionID]

 

I wouldn't have come to that realization had it not been for your reply. Thank you!

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...