<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Need help on alert in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-on-alert/m-p/573255#M47041</link>
    <description>&lt;P&gt;Sorry man&amp;nbsp;&lt;/P&gt;&lt;P&gt;I forgot to replace "bar" with real values.&lt;/P&gt;</description>
    <pubDate>Tue, 02 Nov 2021 03:13:52 GMT</pubDate>
    <dc:creator>jackin</dc:creator>
    <dc:date>2021-11-02T03:13:52Z</dc:date>
    <item>
      <title>Need help on alert</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-on-alert/m-p/573126#M47028</link>
      <description>&lt;UL&gt;&lt;LI&gt;I have some error keywords. These words all come in Raw data. I put them in a lookup file, lookup file name is mylookup.csv . Now I need to get an email alert when I have the word triggered in that file. Thanks in advance&lt;/LI&gt;&lt;/UL&gt;</description>
      <pubDate>Mon, 01 Nov 2021 07:07:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-on-alert/m-p/573126#M47028</guid>
      <dc:creator>jackin</dc:creator>
      <dc:date>2021-11-01T07:07:05Z</dc:date>
    </item>
    <item>
      <title>Re: Need help on alert</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-on-alert/m-p/573153#M47031</link>
      <description>&lt;P&gt;It would help to know what you've tried so far and what results you got.&lt;/P&gt;&lt;P&gt;I'm hoping this is not one of the failed attempts:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;index=foo [ inputlookup mylookup.csv | return 1000 $bar ]&lt;/LI-CODE&gt;</description>
      <pubDate>Mon, 01 Nov 2021 12:37:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-on-alert/m-p/573153#M47031</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2021-11-01T12:37:34Z</dc:date>
    </item>
    <item>
      <title>Re: Need help on alert</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-on-alert/m-p/573155#M47032</link>
      <description>&lt;P&gt;Thanks &lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957"&gt;@richgalloway&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;It's not working.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 01 Nov 2021 13:11:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-on-alert/m-p/573155#M47032</guid>
      <dc:creator>jackin</dc:creator>
      <dc:date>2021-11-01T13:11:16Z</dc:date>
    </item>
    <item>
      <title>Re: Need help on alert</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-on-alert/m-p/573239#M47038</link>
      <description>&lt;P&gt;What does that mean?&amp;nbsp; "It's not working" doesn't paint much of a picture I can use to help you.&lt;/P&gt;&lt;P&gt;Please share the exact query you ran (did you replace "foo" and "bar" with real values?) and the results you received.&lt;/P&gt;</description>
      <pubDate>Mon, 01 Nov 2021 20:05:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-on-alert/m-p/573239#M47038</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2021-11-01T20:05:54Z</dc:date>
    </item>
    <item>
      <title>Re: Need help on alert</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-on-alert/m-p/573255#M47041</link>
      <description>&lt;P&gt;Sorry man&amp;nbsp;&lt;/P&gt;&lt;P&gt;I forgot to replace "bar" with real values.&lt;/P&gt;</description>
      <pubDate>Tue, 02 Nov 2021 03:13:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-on-alert/m-p/573255#M47041</guid>
      <dc:creator>jackin</dc:creator>
      <dc:date>2021-11-02T03:13:52Z</dc:date>
    </item>
  </channel>
</rss>

