How to find changing serial numbers?

[splunk_enjoyer]

Hello Splunk Enjoyers! I have problem

Information about routers arrives every minute, so 

What I have:  name_of_router and serial_number of client on index = routers

What i want: i want to make alert, if serial_number has changed. 

How should i do this?

@splunk 

[splunk_enjoyer]

@ITWhisperer thanks! its work!

and how can i result serial number and serial_number where serial_number >1? not count

[ITWhisperer]

If you want to keep the events, use eventstats

| eventstats dc(serial_number) as count by name
| where count > 1

[splunk_enjoyer]

@ITWhisperer  its works! 

so how can i result events where serial number had changed, not count

[ITWhisperer]

Can you share some depersonalised events in a code block </>

[splunk_enjoyer]

for example: 

| table name serial_number

result:

name            | serial_number 

cisco1          |   ABC123456

cisco1          |  cdf95959595

[ITWhisperer]

| stats dc(serial_number) as count by name
| where count > 1