Splunk Search

How do I create an alert that is triggered if group name exists in a lookup table?


I want to create an alert that triggers when a user_name  exist in a lookup table (e.g. group_names.csv). But I'm not sure how to create the search string for this. The fields I'm using in the group_names.csv lookup table is group_names type as follows:

If the user_name matches group_names listed in the table, the alert should triggered. Any help on how to do this are much appreciated.


Labels (1)
0 Karma


To match user_name with group_names listed in a lookup, you can use a subsearch if there is no other condition that you need to calculate.

<some additional filters>
  [ | inputlookup group_names.csv
  | rename group_names as user_name ]
| stats count by user_name

Hope this helps.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...