How to dynamically change table contents based on log messages?

[kiddsupreme]

Not sure if I am putting this in the correct area; my apologies ahead of time. I wanted to know if it would be possible to have Splunk dynamically populate a table based on incoming log messages. The log messages for new alerts and cleared alerts are essentially the same, save for one "field" that shows either "NEW" or "CLEARED".

##Example of New Alert Log Message## 

2022-10-06 05:58:31
AlarmNotification = NEW
AlarmID = STRING: "123456789"
AlarmType = INTEGER: 1
ObjectInstance = STRING: "Router1"
EventTime = STRING: "2022-10-6,5:58:31.7,-7:0"
SpecificProblem = STRING: "LinkDown"
Severity = INTEGER: 2

##Example of Clear Alert Log Message##

2022-10-06 05:58:35
AlarmNotification = CLEARED
AlarmID = STRING: "123456789"
AlarmType = INTEGER: 1
ObjectInstance = STRING: "Router1"
EventTime = STRING: "2022-10-6,5:58:35.5,-7:0"
SpecificProblem = STRING: "LinkDown"
Severity = INTEGER: 2

-----------------------------------

My idea was anytime a new alert comes in, a table with the various fields is generated; I can already do that today. However, what I am not sure about is if a subsequent "clear" log message comes in where everything matches (with the exception of the AlarmNotification and EventTime), it would dynamically REMOVE that table row entry.

So the general idea is show the alerts when they come in, but if a cleared alert message that comes in with a later date and time would "delete" that row from the table.

Any and all suggestions are welcomed. Thank you in advance.

[yuanliu]

I thought the entire idea of Splunk is to dynamically change table content based on log messages.  No?  Joking aside, one possible method is to use transaction.

| transaction startswith="AlarmNotification=NEW" endswith="AlarmNotification=CLEARED" AlarmID
| where closed_txn == 0

Here I assume that AlarmID uniquely identifies an alarm that is being cleared.  If not, you can add other fields necessary to identify alarm.

There are many methods to use stats to accomplish this, too.  Assuming AlarmID is unique, you can do

| stats values(*) as * by AlarmID
| where NOT AlarmNotification == "CLEARED"

Transaction is expensive.  So stats is usually preferred.

Hope this helps.