Splunk Search

Update a single field in lookup table from a search

watsm10
Communicator

Fellow Splunkers,

I've got an automatic lookup table (lookup.csv) which has a field in called Count. Every time my search runs (triggered alert) I'd like the count field to be incremented by 1, so that I can see how many times the alert has been triggered previously and include this in the alert email as a field from the lookup table.

I've tried this, but it hasn't worked for me:
| eval Count=Count+1 | outputlookup Count lookup.csv

Do I need to run a subsearch? I'm not entirely sure how to do it.

How would I go about doing this?

Many thanks.

0 Karma

sowings
Splunk Employee
Splunk Employee

You're so close!

Begin with | inputlookup lookup.csv then do your | eval | outputlookup. I utilize this method quite frequently to keep CSVs well groomed.

0 Karma

watsm10
Communicator

Here is my search:
sourcetype="production_env" | chart eval(round(((count(eval(Status="Error"))/count)*100),2)) as "FailureRate", values(Threshold) as "Threshold", values(AlertStatus) as "AlertStatus", values(FailCount) as "Total Alerts" by ServiceNameLookup | eval AlertStatus = if(FailureRate>Threshold, "Failure rate over ".Threshold."% for the last 15 mins","OK") | rename ServiceNameLookup as "Service Name", FailureRate as "Failure Rate"

It invokes the lookup table with a list of service names and thresholds, then compares the failure rate against the threshold. How would adapt your method?

sowings
Splunk Employee
Splunk Employee

If it's part of an alerting search, then I'd say "yes", but to be sure, I'd have to know what the rest of the search is doing.

If the contents of the lookup table drive the alerting search (i.e. you start with |inputlookup then the result set will include count, and you can output that to update the count. But if the count lookup is completely separate from the alerting results, (that is, the lookup contains only the count) you'll have to tweak the search somewhat.

0 Karma

watsm10
Communicator

Thanks, so shall I just pipe this onto the end of my search? Or have this as a subsearch which runs and updates it separately?

Many thanks.

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...