Update lookup file values dynamically

bt149 — Tue, 17 Oct 2023 11:04:28 GMT

I have a lookup file. Lookup has "host", "count", "first_event" and "last_event" fields. I want to run a search hourly that will update all the fields with fresh values and in the event that a "host" is not found in the search send an alert.

Any guidance would be appreciated.

Re: Update lookup file values dynamically

gcusello — Tue, 17 Oct 2023 11:13:21 GMT

Hi @bt149,

for the lookup population search you could try something like this:

<your_search> | stats count earliest(_time) AS first_event latest(_time) AS last_event BY host | outputlookup your_lookup.csv

for the alert the fires eventual missing hosts, you could try:

Ciao.

Giuseppe

topic Update lookup file values dynamically in Splunk Search

Update lookup file values dynamically

Re: Update lookup file values dynamically