topic Re: delete rows from lookup in Alerting

delete rows from lookup

sfurkan — Fri, 26 Mar 2021 07:41:59 GMT

Hi,

There is an alarm monitoring the 4733(A member was removed from a security-enabled local group
) events. When this alarm is triggered, I want the user to be deleted from the users.cvs lookup.

how can I do it?

Thanks,

Re: delete rows from lookup

scelikok — Fri, 26 Mar 2021 07:49:26 GMT

Hi @sfurkan,

You can use below sample;

| inputlookup users.csv where user!=deleted_user | outputlookup users.csv

Re: delete rows from lookup

gcusello — Fri, 26 Mar 2021 07:57:11 GMT

Hi @sfurkan,

I suppose that your alert is something like this:

your_search | table _time user

if your lookup isn't a kvstore, you could try to modify your alert in this way:

your_search | table _time user | outputlookup temp_lookup

then schedule the following two searches to run:

the after 5-10 minutes:

| makeresults | search ppp=XXX | outputlookup temp_lookup

If instead your lookup is a kvstore follow this url https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/aboutkvstorecollections/

Ciao.

Giuseppe

Re: delete rows from lookup

scelikok — Fri, 02 Apr 2021 08:22:36 GMT

Hi @sfurkan,

You can use below sample query. I assume your user.csv has user field.