Hi,
I need to set up an alert with the query like below.
index=abc sourcetype=bcd “abc” File_name=maple.txt earliest=2h@h latest=now
In the above query,the File_name,earliest & latest time has to be picked up from the lookup file.
Condition - if the current time matches with latest time in the lookup file,then the query has to be run for the respective File_name for that timerange(earliest and latest time mentioned in the lookup)
The lookup table to be like below:
File_name earliest latest
Dfg.txt 2 4
Dft.txt 5 6
Ser.txt 5 7
You mean something like:
index=abc sourcetype=bcd “abc”
[| inputlookup <lookup-name> | where latest==now()
| appendpipe [| stats count | where count=0 | eval File_Name="when no match found in the lookup", earliest=0, latest=0]
| table File_Name, earliest, latest ]
The appendpipe is the condition when nothing in the lookup matches the current time. If you can update that part as you wish in that case.
How is this different to what you asked a couple of weeks ago, for which I provided an answer?