Dynamic search with inputlookup

[stephan_berger]

Hello Splunk-Community

Given the following lookup file:



error_modsec_msg, threshold

"SQL Injection Attack", 1000

"Cross-site Scripting (XSS) Attack", 10



Based on this static search:


index=it_apache error_modsec_msg="SQL Injection Attack"| stats count by error_modsec_msg | where count > 1000

Is there a way to make the static search dynamic with the values from the lookup files? So to count every occurence of the errormodsecmsg and compare the count to the threshold from the file? I thought about the inputlokup, but I don't know how to implement the whole solution. Or do I have to make a script?

Thanks in advance for your assistance.

Regards,

Stephan

[somesoni2 · Accepted solution]

Try this

index=it_apache | stats count by error_modsec_msg | lookup <yourlookupfilename> OUTPUT threshold | where count > threshold

[stephan_berger]

Perfect, thank you!