How to alert when a certain field changes from a value to another random value?

[clairebesson]

Hi everyone,

I want to create an alert by email when one of the fields of my index changes. I have a file with different counters with values associated (one column for the counters name and one column for the value).

I would like to be notified by email when the value of one specific counter changes.
I’ve read the documentation about real time alert, but I didn’t find anything that could help me.
Example: Let's say that I am interested in the "counter_1". If the value of counter_1 change I would like to be alerted.

Could you help me with that issue?
Thanks!

[woodcock]

Setup a search to run every X minutes and over the last X+1 minutes (where X is the same number) and search this:

... | stats dc(counter_1) AS numValues | search numValues>1

[sundareshr]

Please share couple of events. Have you extracted these columns as KV pairs? That will have to be your first step. https://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf

Once you have fields extracted, you can do a search with earliest=-5m, this will alert you of any changes in the past 5 mins. Since this is an extracted field, real-time search may not work correctly.

[JDukeSplunk]

If I read you right, then counter_1 is always X. So, setup the alert to exclude expected results, like X. But if counter_1=Y, the search will return a result, and you can alert on that. So...

 basesearch NOT counter_1=expectedvalue

And then setup the alert to run at whatever interval, and alert if number of results is greater than one?