Splunk Search
Highlighted

How to search and trigger an alert if the same value repeats more than once in a certain field for that particular event?

Explorer

For example:

:Report=99,10,99

In this case value 99 occurred twice in this field, so I need to pick this event and then create an alert. Please help in solving this issue

0 Karma
Highlighted

Re: How to search and trigger an alert if the same value repeats more than once in a certain field for that particular event?

SplunkTrust
SplunkTrust

Give this a try (works on Splunk 6.2.0 and above)

your base search | eval temp=split(Report,",") | where mvcount(temp)>mvcount(mvdedup(temp)) | fields - temp
0 Karma
Highlighted

Re: How to search and trigger an alert if the same value repeats more than once in a certain field for that particular event?

Explorer

It dint give me any response

0 Karma