Update a single field in lookup table from a search

[watsm10]

Fellow Splunkers,

I've got an automatic lookup table (lookup.csv) which has a field in called Count. Every time my search runs (triggered alert) I'd like the count field to be incremented by 1, so that I can see how many times the alert has been triggered previously and include this in the alert email as a field from the lookup table.

I've tried this, but it hasn't worked for me:
| eval Count=Count+1 | outputlookup Count lookup.csv

Do I need to run a subsearch? I'm not entirely sure how to do it.

How would I go about doing this?

Many thanks.

[sowings]

You're so close!

Begin with | inputlookup lookup.csv then do your | eval | outputlookup. I utilize this method quite frequently to keep CSVs well groomed.

[watsm10]

Here is my search:
sourcetype="production_env" | chart eval(round(((count(eval(Status="Error"))/count)*100),2)) as "FailureRate", values(Threshold) as "Threshold", values(AlertStatus) as "AlertStatus", values(FailCount) as "Total Alerts" by ServiceNameLookup | eval AlertStatus = if(FailureRate>Threshold, "Failure rate over ".Threshold."% for the last 15 mins","OK") | rename ServiceNameLookup as "Service Name", FailureRate as "Failure Rate"

It invokes the lookup table with a list of service names and thresholds, then compares the failure rate against the threshold. How would adapt your method?

[sowings]

If it's part of an alerting search, then I'd say "yes", but to be sure, I'd have to know what the rest of the search is doing.

If the contents of the lookup table drive the alerting search (i.e. you start with |inputlookup then the result set will include count, and you can output that to update the count. But if the count lookup is completely separate from the alerting results, (that is, the lookup contains only the count) you'll have to tweak the search somewhat.

[watsm10]

Thanks, so shall I just pipe this onto the end of my search? Or have this as a subsearch which runs and updates it separately?

Many thanks.