Splunk Search

Alert when row count for two searches are not equal

seomaniv
Explorer

I have two events: items received, and items acted on. I want to set an alert when the count by transactionID is not equal for the two searches. I have the search set up like so:

 

index=myIndex source=mySource 
| search criteriaForItemsReceived
| stats count as itemsReceived by transactionID
| append
    [ search index-myIndex source=mySource
    | search criteriaForItemsProcessed
    | stats count as itemsProcessed by transactionID ]
| stats values(*) as * by transactionID

 

ok, it's a little more complicated, but this is the important part. So then need to compare itemsReceived to itemsProcessed to determine if there should be an alert. I have tried

 

... stats values(eval(itemsReceived-itemsProcessed)) as Difference ...
| search Difference != 0

 

as well as doing the eval before the stats, but everything I try ends up with null values for the eval, even though the table is properly populated with the values for itemsReceived and itemsProcessed (I have also tried convert num(itemsReceived) and tonumber(itemsReceived,10) in the event Splunk was not recognizing these fields as numbers, but each time, the fields are null).

What am I doing wrong here?

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The problem may be with the values(*) clause returning multi-field values, which most other functions can't handle.  Try this alternative:

 

index=myIndex source=mySource 
| search criteriaForItemsReceived
| eval state="Rcvd"
| append
    [ search index-myIndex source=mySource
    | search criteriaForItemsProcessed
    | eval state="Proc" ]
| stats count(eval(state="Rcvd")) as itemsReceived, count(eval(state="Proc")) as itemsProcessed by transactionID
| eval Difference = itemsReceived - itemsProcessed 
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The problem may be with the values(*) clause returning multi-field values, which most other functions can't handle.  Try this alternative:

 

index=myIndex source=mySource 
| search criteriaForItemsReceived
| eval state="Rcvd"
| append
    [ search index-myIndex source=mySource
    | search criteriaForItemsProcessed
    | eval state="Proc" ]
| stats count(eval(state="Rcvd")) as itemsReceived, count(eval(state="Proc")) as itemsProcessed by transactionID
| eval Difference = itemsReceived - itemsProcessed 
---
If this reply helps you, Karma would be appreciated.

seomaniv
Explorer

Thank you, Rich. Wasn't exactly my solution, but your post gave me my solution. What I ended up doing was:

 

| stats values(*) as *
| eval Difference = itemsReceived - itemsProcessed
| appendcols [stats values(Difference) as Difference by transactionID]

 

I wouldn't have come to that realization had it not been for your reply. Thank you!

Tags (2)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...