How do I create an alert that is triggered if group name exists in a lookup table?

AL3Z — Wed, 09 Aug 2023 17:01:12 GMT

Hi,
I want to create an alert that triggers when a user_name exist in a lookup table (e.g. group_names.csv). But I'm not sure how to create the search string for this. The fields I'm using in the group_names.csv lookup table is group_names type as follows:

If the user_name matches group_names listed in the table, the alert should triggered. Any help on how to do this are much appreciated.

Thanks..

Re: How do I create an alert that is triggered if group name exists in a lookup table?

yuanliu — Sat, 12 Aug 2023 00:43:39 GMT

To match user_name with group_names listed in a lookup, you can use a subsearch if there is no other condition that you need to calculate.

<some additional filters> [ | inputlookup group_names.csv | rename group_names as user_name ] | stats count by user_name

Hope this helps.

topic Re: How do I create an alert that is triggered if group name exists in a lookup table? in Splunk Search

How do I create an alert that is triggered if group name exists in a lookup table?

Re: How do I create an alert that is triggered if group name exists in a lookup table?