topic Alerting using inputlookup in Alerting

Alerting using inputlookup

jlayson — Thu, 14 Jan 2021 09:30:19 GMT

Hi all, im new in splunk, i was wondering if you can help me. This is the scenario, im using inputlookup. I have csv file with 2 fields field1 is original ip then field 2 is second ip. What i wanted to do if the user get one of ip address in field 1 and get any ip address in the field 2 then it will alert. But if the user only get ip address in field 1 and did not get ip address in field2 it will not alert. I have multiple ip address in field 1 and only 4 ip address in field 2. Thank you

Re: Alerting using inputlookup

ITWhisperer — Thu, 14 Jan 2021 09:41:25 GMT

Where is "user" coming from (given that your csv only contains ip addresses)?

First you need to build a search query that returns the result you want to alert on. Do you have this already?

Re: Alerting using inputlookup

jlayson — Thu, 14 Jan 2021 09:50:42 GMT

We already have an alert , i just need to add that on the alert as an update. The user will use there own IP address which is indicated in field 1 then the field 2 are 4 address that are not allowed to use if they are using any of the ip address on field1

Re: Alerting using inputlookup

ITWhisperer — Thu, 14 Jan 2021 10:12:59 GMT

Can you share what you currently have?