Splunk Search

How do I create an alarm if a value stored in a CSV changes?

josedgaravito
New Member

Hi, I have a CSV file with the following structure:

NAME             DiskSerial                 ProcSerial                  MachineSerial
PC-ID-0007  null                                 BFEBFBFF000306F2             MJ044SGB
PC-ID-0088  WD-WX11DC7JHUV0                   BFEBFBFF000306F2             MJ044SH9
PC-ID-5177  NA8GAPCF                              BFEBFBFF000306F2              58Y0KB2

I need to create a search to identify if any of the series that have been stored change.

taking into account the last event that enters the indexer.

0 Karma

Sukisen1981
Champion

you have to have one common or 'key' field, for example can NAME field be treated as a key field?
So, say for PC-ID-007 if another entry is logged AND any of the remaining 3 fields have a different value, you need to identify that?

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...