There is a way to send some fileds of an alert to a kvs lookup?

[AleCanzo]

Hi, this is my first interaction with Splunk Community so be patient please 🙂 
I'm trying to output some fields from an Alert to a kvs lookup. I'm using a Lookup editor app and a KVS app, but probably i'm missing some theory. Thanks!

[AleCanzo]

No, i'm trying to do something different. Every time my Alert is triggered, i want to output some fields (like severity, expiration, ss_name...) to a kvs lookup. Then i want to see the lookup on a dashboard: i'm doing this cause i'm trying to create an app where i can manage alerts (like Alert Manager). Of course i can just create a dashboard where i table all the events from the Alert, but then i'm not sure i'm going to be able to modify the table.

[ITWhisperer]

Without concrete examples, I can only guess what might work, but you could try using appendpipe. For example:

<your search to determine whether an alert should be raised>
| appendpipe
  [| eval alert_raised=time() ``` Create a field to show when the alert was raised ```
   ``` Reduce fields to only those required (including alert_raised) ```
   | table severity, expiration, ss_name, alert_raised
   ``` Output fields to lookup ```
   | outputlookup alerts_raised.csv append=true
   ``` Remove appended events ```
   | where isnull(alert_raised)]

[livehybrid]

Hi @AleCanzo 

You can use outputlookup (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/outputlookup) in your query to output the fields in your results to a KV Store, just the same as a CSV lookup - is this what you're looking to achieve?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing