I am trying to get an alert to recognize a lookup file with a whitelist for external devices. Some devices I don't care to see where others I do. I only want the alert to trigger when the whitelist is set to 0 and based on the search field of Device_ID. For unknown reasons though the alert still triggers despite the settings. I am also using an asterisk for my Device_IDs and have updated the lookup definition using WILDCARD(Make_Model). My search mode is set to Fast Mode and I have tried the others as well. I am manually populating the lookup file.
index=xxxx EventCode=6416 NOT Device_ID IN(SWD*,DISPLAY*)
| lookup pnp Make_Model as Device_ID
| search NOT WhiteList=1
"pnp" is the name of my lookup definition. The csv file was imported into splunk enterprise and appears under lookup table files.
Appreciate any recommendations or other suggestions on how to improve this search and lookup file.
