topic Re: Verify Splunk Alert in Alerting https://community.splunk.com/t5/Alerting/Verify-Splunk-Alert/m-p/47415#M613 <P>You'll need to <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/ExtractNewFields">extract a field</A> for the hostname. Then you can <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups">define a lookup</A> which has the details of valid hosts. You could also consider <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/TagAndAliasFieldValues">tags</A>. Finally tie it all together by adding either <CODE>tag=</CODE> or <CODE>lookup=</CODE> to your search.</P> Tue, 04 Sep 2012 16:17:11 GMT dart 2012-09-04T16:17:11Z Verify Splunk Alert https://community.splunk.com/t5/Alerting/Verify-Splunk-Alert/m-p/47414#M612 <P>Hi,</P> <P>I think I have a quiet complicated request.</P> <P>Lets say I have the following event, which contains</P> <PRE><CODE>LDAP error for hostXYZ </CODE></PRE> <P>It is a real-time search configured which is triggering the words LDAP AND error.</P> <P>Now I want to check before the alert appear, if the hostXYZ is valid. So all hosts which generates the event with error and LDAP should checked against a lookup which contains a table if the host is valid.</P> <P>Thank you very much</P> Thu, 30 Aug 2012 13:36:07 GMT https://community.splunk.com/t5/Alerting/Verify-Splunk-Alert/m-p/47414#M612 nebel 2012-08-30T13:36:07Z Re: Verify Splunk Alert https://community.splunk.com/t5/Alerting/Verify-Splunk-Alert/m-p/47415#M613 <P>You'll need to <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/ExtractNewFields">extract a field</A> for the hostname. Then you can <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups">define a lookup</A> which has the details of valid hosts. You could also consider <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/TagAndAliasFieldValues">tags</A>. Finally tie it all together by adding either <CODE>tag=</CODE> or <CODE>lookup=</CODE> to your search.</P> Tue, 04 Sep 2012 16:17:11 GMT https://community.splunk.com/t5/Alerting/Verify-Splunk-Alert/m-p/47415#M613 dart 2012-09-04T16:17:11Z