topic Re: Custom alert based on inputlookup table not sending alerts in Alerting

Custom alert based on inputlookup table not sending alerts

esmonder — Tue, 29 Sep 2020 19:25:01 GMT

I have several inputlookup tables that are updated on a frequent basis and i want to detect new cases based on several conditions. However since the inputlookup tables have no default _time field, i created a Time field to act as a timestamp based on a time field (date_last) in the table. My code:

| inputlookup mylookup.csv where <conditions>
| eval _time=strptime(date_last, "%Y-%m-%dT%H:%M:%S.000Z")
| sort _time 
| addinfo 
| where _time>=info_min_time AND (_time<=info_max_time OR info_max_time="+Infinity")
| eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S")
| table Time, srcip, org, source

However, the above is not sending any alerts and i am wondering whether inputlookups are able to do so?

Re: Custom alert based on inputlookup table not sending alerts

xpac — Fri, 04 May 2018 05:06:50 GMT

What is your alert condition?

Re: Custom alert based on inputlookup table not sending alerts

esmonder — Fri, 04 May 2018 06:05:38 GMT

just searching for events within a country

Re: Custom alert based on inputlookup table not sending alerts

woodcock — Fri, 04 May 2018 07:07:35 GMT

The events that come from inputlookup are no different than any others in any way that matters. The only thing that looks potentially limiting is that you should be using sort 0 _time instead of sort _time but that's a long shot and unlikely to be your problem. It all depends on your actual data.