Splunk Search
Highlighted

Can a Splunk alert be triggered by comparing the row counts of two searches?

Explorer

I would like to compare the row count returned from two searches and trigger an alert based on whether search 1 returns more rows than search 2. Is there a way to do this?

Thanks,
Jonathan

0 Karma
Highlighted

Re: Can a Splunk alert be triggered by comparing the row counts of two searches?

SplunkTrust
SplunkTrust

Yes, a simple implementation would be like this. More accurate/optimized suggestions if you can share your searches.

search1 | stats count as count1| appendcols [search search2 | stats count as count2] | where count1>count2
0 Karma
Highlighted

Re: Can a Splunk alert be triggered by comparing the row counts of two searches?

Splunk Employee
Splunk Employee

@jbrenner - Were you able to test out somesoni2's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

0 Karma