Update lookup file values dynamically

[bt149]

I have a lookup file.  Lookup has "host", "count", "first_event" and "last_event" fields.  I want to run a search hourly that will update all the fields with fresh values and in the event that a "host" is not found in the search send an alert.

Any guidance would be appreciated.

[gcusello]

Hi @bt149,

for the lookup population search you could try something like this:

<your_search>
| stats 
   count
   earliest(_time) AS first_event
   latest(_time) AS last_event
   BY host
| outputlookup your_lookup.csv

for the alert the fires eventual missing hosts, you could try:

<your_search>
| stats 
   count
   BY host
| append [ | your_lookup | eval count=0 | fields host count]
| stats 
   sum(count) AS count
   BY host
| where count=0

Ciao.

Giuseppe