Verify Splunk Alert

[nebel]

Hi,

I think I have a quiet complicated request.

Lets say I have the following event, which contains

LDAP error for hostXYZ

It is a real-time search configured which is triggering the words LDAP AND error.

Now I want to check before the alert appear, if the hostXYZ is valid. So all hosts which generates the event with error and LDAP should checked against a lookup which contains a table if the host is valid.

Thank you very much

[dart · Accepted solution]

You'll need to extract a field for the hostname. Then you can define a lookup which has the details of valid hosts. You could also consider tags. Finally tie it all together by adding either tag= or lookup= to your search.