How to create a Splunk alert upon any new table entry

[rsantkumar]

Hi. I have a splunk table which tracks  all the plugin version available to install for each plugin. Please note that each plugin can have multiple values. The idea is to alert when a new  version becomes available for any of the plugins(latest entry). the search runs every 5 mins.

Kindly help.

[jacobpevans]

By "splunk table", I assume you mean the results of a search as it appears in your screenshot. If this is the case, you can compare the current data to a previous time's data. The search below will retrieve the unique data from the previous five minutes but only if it is not present in the previous day outside that five minute window.

index=<your_index> sourcetype=<your_sourcetype> earliest=-5m latest=now
| table key Plugin_version Release
| search NOT
    [ | search index=<your_index> sourcetype=<your_sourcetype> earliest=-1d latest=-5m
      | table key Plugin_version Release ]

[gcusello]

Hi @rsantkumar,

To solve your requirement, you could have two approaches:

extract all the versions of each product and check that every target host has the highest, or, in different words, that they have all the same version.

In this way you cannot check the alignment with the newest version but only that all the versions are aligned.

Otherwise, you could create a lookup containing the latest version of each product to verify and check if all the targets are aligned with this version.

Ciao.

Giuseppe

[rsantkumar]

@gcusello: Thanks for your reply. The problem with these approaches in my case is that the release of versions is quite often and the idea is to notify us as soon as a new version is available for a plugin for us to use.