Splunk Search

Alert setup using lookup and WhiteList

bz
New Member

I am trying to get an alert to recognize a lookup file with a whitelist for external devices.  Some devices I don't care to see where others I do.  I only want the alert to trigger when the whitelist is set to 0 and based on the search field of Device_ID.  For unknown reasons though the alert still triggers despite the settings.  I am also using an asterisk for my Device_IDs and have updated the lookup definition using WILDCARD(Make_Model).  My search mode is set to Fast Mode and I have tried the others as well.  I am manually populating the lookup file.

index=xxxx EventCode=6416 NOT Device_ID IN(SWD*,DISPLAY*)
| lookup pnp Make_Model as Device_ID
| search NOT WhiteList=1

"pnp" is the name of my lookup definition.  The csv file was imported into splunk enterprise and appears under lookup table files.

Appreciate any recommendations or other suggestions on how to improve this search and lookup file.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...