Hello,
Is there way to create an alert based on the thresholds in a lookup table?
I have a search which will give you whether a sourcetype has no data coming for last 10 mins, but now I am thinking to have a lookup file which has each sourcetype name and its threshold. Can we create an alert which will trigger for each sourcetype based on the threshold value in the lookup table?
Thanks in advance
Let's say it is a lookup by sourcetype where your CSV has sourcetype,threshold
values in it and is called SourcetypeThresholdLookup
:
YOUR SEARCH HERE | stats count BY sourcetype | lookup SourcetypeThresholdLookup sourcetype | where count>=threshold
Then set your alert for number of events is greater than 0
.
Thank You for your quick response Woodcock,will try this and let you know..thanks a lot again