Splunk Search

How to create an alert based on lookup file

prettysunshinez
Explorer

Hi,

I need to set up an alert with the query like below.

index=abc sourcetype=bcd “abc” File_name=maple.txt earliest=2h@h latest=now

In the above query,the File_name,earliest & latest time has to be picked up from the lookup file.
Condition - if the current time matches with latest time in the lookup file,then the query has to be run for the respective File_name for that timerange(earliest and latest time mentioned in the lookup)

The lookup table to be like below:

File_name earliest latest
Dfg.txt 2 4
Dft.txt 5 6
Ser.txt 5 7

Labels (2)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

You mean something like:

index=abc sourcetype=bcd “abc” 
[| inputlookup <lookup-name> | where latest==now() 
| appendpipe [| stats count | where count=0 | eval File_Name="when no match found in the lookup", earliest=0, latest=0]
 | table File_Name, earliest, latest ]

 

The appendpipe is the condition when nothing in the lookup matches the current time. If you can update that part as you wish in that case.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How is this different to what you asked a couple of weeks ago, for which I provided an answer?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...