Hi all. I have been working on a query to alert us to when a date changes for a specific item, the item is represented in my query as GroupId. Dates can change any number of times, and I want to receive an alert whenever they do.
I have come up with the following real-time search. I am concerned about it only having the data available from when the search starts.
index=daluat PublishedGtpRule GroupId | dedup 100 GroupId sortby -_time | stats first(Date) As CurrentDate list(Date) As PreviousDates dc(Date) As Count by GroupId | where Count>1
I'll try my best to explain what I think would work best.
Search for distinct GroupIds over a time period
For each GroupId, search for the previous occurrence of it - all time
Result if date has changed
Preferably I'd like to see what the new and previous dates are too.
This way my alerting doesn't have to be real-time. I can simply run it every minute, and look back over the last 2 or 3 minutes and allow the subsearch to go back through all time to find the last occurrence of a GroupId.
FYI the number of GroupIds per minute is a low number, 10 at most.
... View more