newb help creating an alert

[plastiiq]

Hi there,

i'm somewhat new to splunk and hoping some of the more seasoned veterans can assist me.

I have a process hashing a file and writing some output to a log.

the entries look like this:

Wed 11/21/201215:17:54.38 //// File Checksum Integrity Verifier version 2.05.//31127455faac11149dfdabc2261cdb7a c:\integrity\integrityservicex.exe
host=WIN-IK3D6F4B55R Options| sourcetype=integrity-too_small Options|

source=C:\Program Files\SplunkUniversalForwarder\integrity.txt Options

it is being indexed and is searchable properly.

what I wanted to to was create an alert for when the hash entry changes, in this case the hash is :31127455faac11149dfdabc2261cdb7a

so I would always expect the valid entry to exist in the file, what I want to do is detect an invalid entry (the hash has changed) and alert based on that.

Could anyone offer a few hints to get me started?

[yannK]

A method will be to use a field extraction to get the value of the hash from each event.
Then pick a timerange and get the first and last hash of the events and add some logic.
Finally setup an alert on the number of results > 0

<mysearch>
| rex "version \d+\.\d+.(|\d+)//(?<hash>[\w\d]*)"
| stats latest(_time) as _time latest(hash) AS newhash earliest(hash) AS oldhash
| WHERE NOT newhash=oldhash
| table _time newhash