Alerting

Custom alert based on inputlookup table not sending alerts

esmonder
Path Finder

I have several inputlookup tables that are updated on a frequent basis and i want to detect new cases based on several conditions. However since the inputlookup tables have no default _time field, i created a Time field to act as a timestamp based on a time field (date_last) in the table. My code:

| inputlookup mylookup.csv where <conditions>
| eval _time=strptime(date_last, "%Y-%m-%dT%H:%M:%S.000Z")
| sort _time 
| addinfo 
| where _time>=info_min_time AND (_time<=info_max_time OR info_max_time="+Infinity")
| eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S")
| table Time, srcip, org, source

However, the above is not sending any alerts and i am wondering whether inputlookups are able to do so?

0 Karma

woodcock
Esteemed Legend

The events that come from inputlookup are no different than any others in any way that matters. The only thing that looks potentially limiting is that you should be using sort 0 _time instead of sort _time but that's a long shot and unlikely to be your problem. It all depends on your actual data.

xpac
SplunkTrust
SplunkTrust

What is your alert condition?

0 Karma

esmonder
Path Finder

just searching for events within a country

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!