topic Re: add field to lookup in Alerting

add field to lookup

sfurkan — Mon, 22 Mar 2021 08:09:06 GMT

Hi,

When an alarm is triggered, I want a field inside the event (e.g user) to be added to a preexisting lookup file.

How can I do?

Thanks,

Re: add field to lookup

gcusello — Mon, 22 Mar 2021 08:57:36 GMT

Hi @sfurkan,

to do this, you have to modify the search in your alert adding at the end the row to modify in the lookup and using the outputlookup command.

The way to do this depends on your situation:

if you have to add a new row to the lookup, it's the easiest situation because you have to add to the outputlookup command the option "append=true",
if you have to modify an existing row, you have to create a new table, containing all the rows of the lookup, modifying only the row related to the alert and then use the output lookup the covers all the rows in the lookup,
if at least you have a kv store, you have to modify the kvstore follwowing the instructions at https://community.splunk.com/t5/Knowledge-Management/How-to-update-a-KV-store-field/m-p/298384.

Ciao.

Giuseppe

Re: add field to lookup

sfurkan — Mon, 22 Mar 2021 12:29:31 GMT

Thanks,

I want to add a row to an existing column in the csv file. Existing records in the csv file should not be deleted.

For example, I want to take user information in the windows event and add it as a row.

Is it not possible to do it from the "trigger actions" section?

Re: add field to lookup

gcusello — Mon, 22 Mar 2021 13:00:23 GMT

Hi @sfurkan,

as I said, if you need to add an entire row, you can add to the end of your alert searcvh:

| outputlookup your_lookup.csv append=true

If instead you want to modifiy only one field of an existing row, the search is more complex.

Anyway it isn't possible to do it from the "trigger actions" section.

Ciao.

Giuseppe

Re: add field to lookup

gcusello — Mon, 22 Mar 2021 13:40:32 GMT

Hi @sfurkan,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma points are appreciated ;_)

Re: add field to lookup

sfurkan — Mon, 22 Mar 2021 13:43:21 GMT

One last question;

How can I add a query to avoid duplicate lines in the csv file? I used the dedup command, but this does not prevent duplicate lines in the csv file.

Re: add field to lookup

gcusello — Mon, 22 Mar 2021 13:55:22 GMT

Hi @sfurkan,

you have to update the timestamp in a lookup with two columns:

host
last connection,

when a condition is trggered, you could run something like this:

In other words, you have to take the values from the search and from the lookup modifying only the values from the main search and savinf the results in the loolup.

If you could share your alert's search and the fields of your lookup I could be more precise

Ciao.

Giuseppe