Splunk Search

Alert setup using lookup and WhiteList

New Member

I am trying to get an alert to recognize a lookup file with a whitelist for external devices.  Some devices I don't care to see where others I do.  I only want the alert to trigger when the whitelist is set to 0 and based on the search field of Device_ID.  For unknown reasons though the alert still triggers despite the settings.  I am also using an asterisk for my Device_IDs and have updated the lookup definition using WILDCARD(Make_Model).  My search mode is set to Fast Mode and I have tried the others as well.  I am manually populating the lookup file.

index=xxxx EventCode=6416 NOT Device_ID IN(SWD*,DISPLAY*)
| lookup pnp Make_Model as Device_ID
| search NOT WhiteList=1

"pnp" is the name of my lookup definition.  The csv file was imported into splunk enterprise and appears under lookup table files.

Appreciate any recommendations or other suggestions on how to improve this search and lookup file.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...