I have a lookup table with 3 fields/columns: Service, Priority, Threshold. If the search on service count is > (value of Threshold in lookup table) then send an alert.
Service Priority Threshold
Output P2 25
Input P3 10
Both P2 35
If search result > Threshold then send alert. What would my search look like?
index=xxx service=* | lookup tablename Service OUTPUT Service, Priority, Threshold | stats count by Service Threshold
if count is > Threshold
looks good, but use |where count>threshold