Splunk Search

How do I create an alarm if a value stored in a CSV changes?

josedgaravito
New Member

Hi, I have a CSV file with the following structure:

NAME             DiskSerial                 ProcSerial                  MachineSerial
PC-ID-0007  null                                 BFEBFBFF000306F2             MJ044SGB
PC-ID-0088  WD-WX11DC7JHUV0                   BFEBFBFF000306F2             MJ044SH9
PC-ID-5177  NA8GAPCF                              BFEBFBFF000306F2              58Y0KB2

I need to create a search to identify if any of the series that have been stored change.

taking into account the last event that enters the indexer.

0 Karma

Sukisen1981
Champion

you have to have one common or 'key' field, for example can NAME field be treated as a key field?
So, say for PC-ID-007 if another entry is logged AND any of the remaining 3 fields have a different value, you need to identify that?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...