Splunk Search

alert when json data changes

gdavid
Path Finder

is there a way to alert when json data changes? 

i want to track changes for a variety of apis results/output that should stay static. i want to know when they change with an email. my thought is to daily grab the api data via powershell and post it to splunk via http collector or flat file input via forwarder.

is it possible to have splunk alert on change, and a plus would be providing the key/value pair that changed. 

 

thanks

Gd.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In general, if you can search for it in Splunk then you can alert on it.  I suggest you create a test index and add your JSON data to it.  Then experiment with searches to find when data changes.  If you have problems with that, you can post new, specific questions.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...