Alerting

Custom alert based on inputlookup table not sending alerts

esmonder
Path Finder

I have several inputlookup tables that are updated on a frequent basis and i want to detect new cases based on several conditions. However since the inputlookup tables have no default _time field, i created a Time field to act as a timestamp based on a time field (date_last) in the table. My code:

| inputlookup mylookup.csv where <conditions>
| eval _time=strptime(date_last, "%Y-%m-%dT%H:%M:%S.000Z")
| sort _time 
| addinfo 
| where _time>=info_min_time AND (_time<=info_max_time OR info_max_time="+Infinity")
| eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S")
| table Time, srcip, org, source

However, the above is not sending any alerts and i am wondering whether inputlookups are able to do so?

0 Karma

woodcock
Esteemed Legend

The events that come from inputlookup are no different than any others in any way that matters. The only thing that looks potentially limiting is that you should be using sort 0 _time instead of sort _time but that's a long shot and unlikely to be your problem. It all depends on your actual data.

xpac
SplunkTrust
SplunkTrust

What is your alert condition?

0 Karma

esmonder
Path Finder

just searching for events within a country

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...