topic Re: How to create an alert based on the thresholds in a lookup table? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-based-on-the-thresholds-in-a-lookup-table/m-p/365100#M107682 <P>Thank You for your quick response Woodcock,will try this and let you know..thanks a lot again</P> Thu, 16 Mar 2017 19:52:39 GMT vrmandadi 2017-03-16T19:52:39Z How to create an alert based on the thresholds in a lookup table? https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-based-on-the-thresholds-in-a-lookup-table/m-p/365098#M107680 <P>Hello,</P> <P>Is there way to create an alert based on the thresholds in a lookup table?</P> <P>I have a search which will give you whether a sourcetype has no data coming for last 10 mins, but now I am thinking to have a lookup file which has each sourcetype name and its threshold. Can we create an alert which will trigger for each sourcetype based on the threshold value in the lookup table?</P> <P>Thanks in advance</P> Thu, 16 Mar 2017 19:16:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-based-on-the-thresholds-in-a-lookup-table/m-p/365098#M107680 vrmandadi 2017-03-16T19:16:10Z Re: How to create an alert based on the thresholds in a lookup table? https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-based-on-the-thresholds-in-a-lookup-table/m-p/365099#M107681 <P>Let's say it is a lookup by sourcetype where your CSV has <CODE>sourcetype,threshold</CODE> values in it and is called <CODE>SourcetypeThresholdLookup</CODE>:</P> <PRE><CODE>YOUR SEARCH HERE | stats count BY sourcetype | lookup SourcetypeThresholdLookup sourcetype | where count&gt;=threshold </CODE></PRE> <P>Then set your alert for <CODE>number of events is greater than 0</CODE>.</P> Thu, 16 Mar 2017 19:40:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-based-on-the-thresholds-in-a-lookup-table/m-p/365099#M107681 woodcock 2017-03-16T19:40:30Z Re: How to create an alert based on the thresholds in a lookup table? https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-based-on-the-thresholds-in-a-lookup-table/m-p/365100#M107682 <P>Thank You for your quick response Woodcock,will try this and let you know..thanks a lot again</P> Thu, 16 Mar 2017 19:52:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-based-on-the-thresholds-in-a-lookup-table/m-p/365100#M107682 vrmandadi 2017-03-16T19:52:39Z