Splunk Search

How to create an alert based on the thresholds in a lookup table?

Builder

Hello,

Is there way to create an alert based on the thresholds in a lookup table?

I have a search which will give you whether a sourcetype has no data coming for last 10 mins, but now I am thinking to have a lookup file which has each sourcetype name and its threshold. Can we create an alert which will trigger for each sourcetype based on the threshold value in the lookup table?

Thanks in advance

0 Karma

Esteemed Legend

Let's say it is a lookup by sourcetype where your CSV has sourcetype,threshold values in it and is called SourcetypeThresholdLookup:

YOUR SEARCH HERE | stats count BY sourcetype | lookup SourcetypeThresholdLookup sourcetype | where count>=threshold

Then set your alert for number of events is greater than 0.

0 Karma

Builder

Thank You for your quick response Woodcock,will try this and let you know..thanks a lot again

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!