topic Re: Is there a way to get Alert from adding lookup in query? in Alerting

Is there a way to get Alert from adding lookup in query?

DougiieDee — Fri, 06 Aug 2021 03:12:50 GMT

I am trying to get the alert when Excerption error happens but there are many hosts and services. In splunk the services and host arent arranged so manually I added the service name and hosts in csv file. is there a way or similar condition to get log events saying this serivce is getting error is this host with the message

Re: Is there a way to get Alert from adding lookup in query?

venkatasri — Fri, 06 Aug 2021 04:36:49 GMT

Hi @DougiieDee

Can you explain bit more easily to understand.

Re: Is there a way to get Alert from adding lookup in query?

DougiieDee — Mon, 09 Aug 2021 20:10:47 GMT

i have a csv file which has host and service. In splunk host is there but not service. i wanted to search with the csv file so it displays as service host and message when the event happened. is there a way to do it?

Re: Is there a way to get Alert from adding lookup in query?

venkatasri — Mon, 09 Aug 2021 23:20:51 GMT

@DougiieDee You can use lookup command prior to that you CSV shall be configured as lookup first assuming you did this already.

You SPL would something like this, when you say Message i hope you are referring to original event itself that's an _raw field in Splunk. host is the the common field hence you output your service. <lookup_name> and <your_search> are just place holders you have to replace them.

<your_search> | lookup <lookup_name> host OUTPUT service | table host service _raw

An upvote would be appreciated if this reply helps!

Re: Is there a way to get Alert from adding lookup in query?

DougiieDee — Tue, 10 Aug 2021 17:34:17 GMT

Thank you worked perfectly. Also is there a way to limit the message like only take first 200 words?

Re: Is there a way to get Alert from adding lookup in query?

venkatasri — Tue, 10 Aug 2021 21:31:58 GMT

@DougiieDee

| head 200 should work.