How to create an alert based on lookup file

[prettysunshinez]

Hi,

I need to set up an alert with the query like below.

index=abc sourcetype=bcd “abc” File_name=maple.txt earliest=2h@h latest=now

In the above query,the File_name,earliest & latest time has to be picked up from the lookup file.
Condition - if the current time matches with latest time in the lookup file,then the query has to be run for the respective File_name for that timerange(earliest and latest time mentioned in the lookup)

The lookup table to be like below:

File_name earliest latest
Dfg.txt 2 4
Dft.txt 5 6
Ser.txt 5 7

[VatsalJagani]

You mean something like:

index=abc sourcetype=bcd “abc” 
[| inputlookup <lookup-name> | where latest==now() 
| appendpipe [| stats count | where count=0 | eval File_Name="when no match found in the lookup", earliest=0, latest=0]
 | table File_Name, earliest, latest ]

The appendpipe is the condition when nothing in the lookup matches the current time. If you can update that part as you wish in that case.

[ITWhisperer]

How is this different to what you asked a couple of weeks ago, for which I provided an answer?