How to print a change in value

[tech_soul]

Hi all,
Please help me to set an alert when a value change occurred.
Also, I need to print old and new values.

[gcusello · Accepted solution]

Hi tech_soul,
could you share more information about your data?
especially if the value to check is continously logged or it appears only one time in a period.

Anyway, I suppose that the value to check is continously logged, try something like this:

index=my_index earliest=-5m latest=now
| stats dc(check_field) AS check
| where check=1

Bye.
Giuseppe