How to Compare two fields from one search with alerting and variable?

[CMEOGNAD]

Hello Community,

i get all 24h a version REST call.
How to get a alert mail with the new version (like 2023-09) as text in the message body, when a new different version appears like...
Line 1: 2023-09
Line 2: 2023-08

index="my_index" source="/var/log/my_version"
| head 2
| spath version

Regards - Markus

[CMEOGNAD]

Looks plausible. I ll test it, and get feedback to you in a month !

[ITWhisperer]

index="my_index" source="/var/log/my_version"
| head 2
| spath version
| streamstats current=f window=2 last(version) as previous_version
| where version != previous_version