I would like generate alert if no event for mentioned destination List for last 30 min.
I have tried below but is not work.
Index=_firewall sourcetype="f5:bigip:asm:syslog" dest_ip="10.10.10.20" earliest= -30m latest=now| stats count by dest_ip,Service| eval count=if (count <=20,0,0)
please try this:
index=_firewall sourcetype="f5:bigip:asm:syslog" dest_ip="10.10.10.20" earliest= -30m latest=now
| stats count by dest_ip Service
| where count<=20
then you have to configure your alert to trigger if there are results (results >0).
For Multiple Destination, Is lookup table will work in same SPL Query
|lookup IPLIST.csv ip AS dest_ip