Splunk Search

Alert setup using lookup and WhiteList

New Member

I am trying to get an alert to recognize a lookup file with a whitelist for external devices.  Some devices I don't care to see where others I do.  I only want the alert to trigger when the whitelist is set to 0 and based on the search field of Device_ID.  For unknown reasons though the alert still triggers despite the settings.  I am also using an asterisk for my Device_IDs and have updated the lookup definition using WILDCARD(Make_Model).  My search mode is set to Fast Mode and I have tried the others as well.  I am manually populating the lookup file.

index=xxxx EventCode=6416 NOT Device_ID IN(SWD*,DISPLAY*)
| lookup pnp Make_Model as Device_ID
| search NOT WhiteList=1

"pnp" is the name of my lookup definition.  The csv file was imported into splunk enterprise and appears under lookup table files.

Appreciate any recommendations or other suggestions on how to improve this search and lookup file.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options A recent Tech Talk, ...

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...