Create an alert based on comparison of two lookup tables

[arikanter]

I have two lookup tables that get updated 1/day from time/CPU intensive searches.

I want to create an alert to let me know when there are deltas between these two lookup tables.  I can schedule as a report, and this works, but then I get empty reports if not deltas are found.

I think the reason my alert is not triggering is because the results from my search are not showing as events, but as statistics.

|inputlookup main.csv |lookup secondary.csv eventSource as eventSource output Name|where isNull(Name)

"Trigger Number of Results" = greater than 0

the search returns results, but no alert is triggered.

[gcusello]

Hui @arikanter,

let me understand: you want an alert that triggers when there's a match between the two lookups, but you want that the alert triggers also when there's no match, is it correct?

if this is your need, you could try a different approach:

| inputlookup main.csv 
| stats count BY eventSource 
| append | inputlookup secondary.csv | eval count=0 | fields eventSource  Name count 
| stats values(name) AS name sum(count) AS total BY eventSource 
| eval status=if(total>0, "match", "no match")
| table eventSource name status

in this way you have a table that lists all the situations (match, no match) that you can filter as you like and you'll have always a result.

One additional hint: in the lookup command, when you have the same fieldname in both lookups, you don't need to write "eventSource AS eventSource ", you can simply write the common key "eventSource " the notation "field1 AS field2" is for the situations when the field names are different.

Ciao.

Giuseppe

[arikanter]

Hi!   Sorry, I wasn't clear enough in my ask.

In my use case, my search will never return events because I'm not searching events, I'm searching lookuptables.   

Results from lookuptables are returned as statistics, not events.

Problem: Splunk alerts (by design?) appear to trigger only when searches return events. 
I want my Splunk alert to trigger on statistics.