Alert Creation for indexes showing events less than threshold

[harshsri21]

I am new to splunk.

Trying to create an alert if any of the indexes shows event count less than the defined threshold. Below is my alert search query which i run every hour past 15.

| metasearch index=ip-bluecoat OR index=ip-fass-siteminder OR index=ip-win-evt OR index=ip-glux
| stats count by index|appendcols [|inputlookup feed_baseline_count.csv|table index,baseline_count]|where count < baseline_count

Below is the table for my lookup:

index baseline_count
ip-bluecoat 3000000
ip-faas_siteminder 1000
ip-glux 2000000
ip-winevt 20000000

It is not working as expected. Can somebody please help in correcting the query or the approach.

Thanks in advance.

[lguinn2]

I think that appendcols is not working as you might expect - it makes no attempt to order the rows so that they "match."
Try this instead:

| tstats count where index=ip-bluecoat OR index=ip-fass-siteminder OR index=ip-win-evt OR index=ip-glux by index
| append [ inputlookup feed_baseline_count.csv ]
| stats first(*) as * by index
| where count < baseline_count

Be sure that you are specifying the timerange properly when you run the search...