Splunk Search

Alert when row count for two searches are not equal

seomaniv
Explorer

I have two events: items received, and items acted on. I want to set an alert when the count by transactionID is not equal for the two searches. I have the search set up like so:

 

index=myIndex source=mySource 
| search criteriaForItemsReceived
| stats count as itemsReceived by transactionID
| append
    [ search index-myIndex source=mySource
    | search criteriaForItemsProcessed
    | stats count as itemsProcessed by transactionID ]
| stats values(*) as * by transactionID

 

ok, it's a little more complicated, but this is the important part. So then need to compare itemsReceived to itemsProcessed to determine if there should be an alert. I have tried

 

... stats values(eval(itemsReceived-itemsProcessed)) as Difference ...
| search Difference != 0

 

as well as doing the eval before the stats, but everything I try ends up with null values for the eval, even though the table is properly populated with the values for itemsReceived and itemsProcessed (I have also tried convert num(itemsReceived) and tonumber(itemsReceived,10) in the event Splunk was not recognizing these fields as numbers, but each time, the fields are null).

What am I doing wrong here?

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The problem may be with the values(*) clause returning multi-field values, which most other functions can't handle.  Try this alternative:

 

index=myIndex source=mySource 
| search criteriaForItemsReceived
| eval state="Rcvd"
| append
    [ search index-myIndex source=mySource
    | search criteriaForItemsProcessed
    | eval state="Proc" ]
| stats count(eval(state="Rcvd")) as itemsReceived, count(eval(state="Proc")) as itemsProcessed by transactionID
| eval Difference = itemsReceived - itemsProcessed 
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The problem may be with the values(*) clause returning multi-field values, which most other functions can't handle.  Try this alternative:

 

index=myIndex source=mySource 
| search criteriaForItemsReceived
| eval state="Rcvd"
| append
    [ search index-myIndex source=mySource
    | search criteriaForItemsProcessed
    | eval state="Proc" ]
| stats count(eval(state="Rcvd")) as itemsReceived, count(eval(state="Proc")) as itemsProcessed by transactionID
| eval Difference = itemsReceived - itemsProcessed 
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

seomaniv
Explorer

Thank you, Rich. Wasn't exactly my solution, but your post gave me my solution. What I ended up doing was:

 

| stats values(*) as *
| eval Difference = itemsReceived - itemsProcessed
| appendcols [stats values(Difference) as Difference by transactionID]

 

I wouldn't have come to that realization had it not been for your reply. Thank you!

Tags (2)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!