Splunk Search

How to set an alert to fire based on lookup table value?

chrisboy68
Contributor

Hi, struggling why I can't seem to get this working. I want to have an alert evaluate to true (trigger) based on if its deemed active or inactive in a lookup table.  The idea would be SPL would alway check the lookup and if the alert SPL evaluates to true, it would do it normal action. This way, we can have numerous alerts that are disabled (evaluate to false) but just updating one value in a lookup table and not clicking Disable for all alerts.  I was thinking i could do something like 

 

 

 

index=main
| append 
    [| inputlookup AlertSample.csv where AlertName=MySampleName
    | fields IsOn]

 

 

 

this and just append the value IsOn to all the events but its not working and I have tried many variants of spl. Suggestions or a better way of doing this? Thank you! Chris

Labels (1)
0 Karma
1 Solution

chrisboy68
Contributor

I figured out a solution. I was over thinking it. 

index=main ```place all your normal SPL here```
| eval alert_name = "myalert" ```create a variable with this alert name or key```
| lookup AlertSample.csv AlertName AS alert_name output IsOn ```lookup table has 2 columns, AlertName and IsOn```
| search IsOn=true ```evalute to true```

If there is a better way, would be glad to hear it.

 

Chris

View solution in original post

0 Karma

chrisboy68
Contributor

I figured out a solution. I was over thinking it. 

index=main ```place all your normal SPL here```
| eval alert_name = "myalert" ```create a variable with this alert name or key```
| lookup AlertSample.csv AlertName AS alert_name output IsOn ```lookup table has 2 columns, AlertName and IsOn```
| search IsOn=true ```evalute to true```

If there is a better way, would be glad to hear it.

 

Chris

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...