Splunk Search

How do I create an alarm if a value stored in a CSV changes?

josedgaravito
New Member

Hi, I have a CSV file with the following structure:

NAME             DiskSerial                 ProcSerial                  MachineSerial
PC-ID-0007  null                                 BFEBFBFF000306F2             MJ044SGB
PC-ID-0088  WD-WX11DC7JHUV0                   BFEBFBFF000306F2             MJ044SH9
PC-ID-5177  NA8GAPCF                              BFEBFBFF000306F2              58Y0KB2

I need to create a search to identify if any of the series that have been stored change.

taking into account the last event that enters the indexer.

0 Karma

Sukisen1981
Champion

you have to have one common or 'key' field, for example can NAME field be treated as a key field?
So, say for PC-ID-007 if another entry is logged AND any of the remaining 3 fields have a different value, you need to identify that?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...