How to set an alert to fire based on lookup table value?

[chrisboy68]

Hi, struggling why I can't seem to get this working. I want to have an alert evaluate to true (trigger) based on if its deemed active or inactive in a lookup table.  The idea would be SPL would alway check the lookup and if the alert SPL evaluates to true, it would do it normal action. This way, we can have numerous alerts that are disabled (evaluate to false) but just updating one value in a lookup table and not clicking Disable for all alerts.  I was thinking i could do something like 

index=main
| append 
    [| inputlookup AlertSample.csv where AlertName=MySampleName
    | fields IsOn]

this and just append the value IsOn to all the events but its not working and I have tried many variants of spl. Suggestions or a better way of doing this? Thank you! Chris

[chrisboy68 · Accepted solution]

I figured out a solution. I was over thinking it. 

index=main ```place all your normal SPL here```
| eval alert_name = "myalert" ```create a variable with this alert name or key```
| lookup AlertSample.csv AlertName AS alert_name output IsOn ```lookup table has 2 columns, AlertName and IsOn```
| search IsOn=true ```evalute to true```

If there is a better way, would be glad to hear it.

Chris