Trigger splunk alert when received values do not change

0
votes

I receive exchange rate from an external web service and I log the response received like below (note both line contain data from a single response):

com.test.Currency@366c1a1e[Id=<Null>,Code=<Null>,Feedcode=Gbparslite,Rate=<Null>,Percentaqechangetrigger=<Null>,Bid=93.4269,Offer=93.43987,Mustinvertprice=False], 
com.test.Currency@54acb93a[Id=<Null>,Code=<Null>,Feedcode=Gbphkdlite,Rate=<Null>,Percentaqechangetrigger=<Null>,Bid=10.04629,Offer=10.04763,Mustinvertprice=False],

I want to set up an alert which triggers when the last x (x=5) values received did not changed.

1
splunksplunk-query

1 Answers

0
votes

Assuming you're looking to alert when a particular field doesn't change after 5 events, you can try the following.

index=data | head 5 | stats dc(Bid) as dv

Then alert if dv equals 1. dc(Bid) calculates the number of unique values of Bid, in this case, over the last 5 events. If there is no difference, they will be 1. If there are multiple values, dc(Bid) will be greater than 1