Raise alert for specific computers

[wnyricsplunk]

I would like to trigger an Alert when event 1074 (Windows Shutdown) is raised but only for specific computers. I have a group of about 50 servers and I would like to know if they shut down but I don't care about workstations in general. Since all events currently go to the same index I need a way to only trigger the alert when one of the servers raises the event. Short of a huge OR statement in my search, is there a way to do something like this?

[mattymo]

Hi! 

You an create a macro to store the hosts that will expand into a filter, as you suggested, or you can use a lookup table that you pull into the search to use as a filter. 

https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesearchmacros

https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-filter-hosts-by-lookup-table-...

[richgalloway · Accepted solution]

Unless there is some other unique attribute of the 50 servers, you have to use a bunch of ORs or a lookup file.

[wnyricsplunk]

Thanks. I will try using a lookup.