If the event count goes below 20 for multiple destination ip

[NDabhi21]

I would like generate alert if no event for mentioned destination List for last 30 min.

I have tried below but is not work.

Index=_firewall sourcetype="f5:bigip:asm:syslog" dest_ip="10.10.10.20" earliest= -30m latest=now
| stats count by dest_ip,Service
| eval count=if (count <=20,0,0)

[gcusello]

Hi @NDabhi21,

please try this:

index=_firewall sourcetype="f5:bigip:asm:syslog" dest_ip="10.10.10.20" earliest= -30m latest=now
| stats count by dest_ip Service
| where count<=20

then you have to configure your alert to trigger if there are results (results >0).

Ciao.

Giuseppe

[NDabhi21]

For Multiple Destination, Is lookup table will work in same SPL Query 

|lookup IPLIST.csv ip AS dest_ip