How to create an alert based on the thresholds in a lookup table?

[vrmandadi]

Hello,

Is there way to create an alert based on the thresholds in a lookup table?

I have a search which will give you whether a sourcetype has no data coming for last 10 mins, but now I am thinking to have a lookup file which has each sourcetype name and its threshold. Can we create an alert which will trigger for each sourcetype based on the threshold value in the lookup table?

Thanks in advance

[woodcock]

Let's say it is a lookup by sourcetype where your CSV has sourcetype,threshold values in it and is called SourcetypeThresholdLookup:

YOUR SEARCH HERE | stats count BY sourcetype | lookup SourcetypeThresholdLookup sourcetype | where count>=threshold

Then set your alert for number of events is greater than 0.

[vrmandadi]

Thank You for your quick response Woodcock,will try this and let you know..thanks a lot again