Lookup creation validation

[rayar]

we are running 2 steps progress

1. Create lookup (by scheduled report )

2. Create index summary using the lookup data  

what will be the best way to make sure the step 2 starts only incase step 1 is completed successfully ?

[aasabatini]

Hi @rayar 

you can check the triggered report or alert with this search:

index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity | rename trigger_time as "Alert Time" ss_name as "Alert Name" severity as "Severity"

after you ran this search you can create alert action to run another search to collect the results.
this is just one method but I think you can use a lot of use case.

[rayar]

The first step is to build the lookup we are running it as a report , how we can verify that the lookup builder is completed ?

the query is running for alerts only 

[aasabatini]

Hi @rayar 

please use these info to build your search, any search are stored on _audit index.
please add on this search these details to understand if is completed

index=_audit action=search info=completed user=[owner of the search] savedsearch_name=[the name of the search]

please remember to add values on user field and savedsearch_name field

[rayar]

I see that even those that failed and weren't fully completed are marked as completed 

[aasabatini]

Hi @rayar,

apologize for the multiple answer but without see the data it's little bit hard.

are you identified the saved search on audit log?

also to show your saved search you can use this search

| rest splunk_server=local /services/saved/searches  | rename eai:acl.owner AS Author eai:acl.sharing AS Permissions eai:acl.app AS App search AS "Saved Search" | fields Author Permissions App "Saved Search"

let me know