Hello Splunk-Community
Given the following lookup file:
error_modsec_msg, threshold
"SQL Injection Attack", 1000
"Cross-site Scripting (XSS) Attack", 10
Based on this static search:
index=it_apache error_modsec_msg="SQL Injection Attack"| stats count by error_modsec_msg | where count > 1000
Is there a way to make the static search dynamic with the values from the lookup files? So to count every occurence of the errormodsecmsg and compare the count to the threshold from the file? I thought about the inputlokup, but I don't know how to implement the whole solution. Or do I have to make a script?
Thanks in advance for your assistance.
Regards,
Stephan
Try this
index=it_apache | stats count by error_modsec_msg | lookup <yourlookupfilename> OUTPUT threshold | where count > threshold
Try this
index=it_apache | stats count by error_modsec_msg | lookup <yourlookupfilename> OUTPUT threshold | where count > threshold
Perfect, thank you!