I have a lookup file. Lookup has "host", "count", "first_event" and "last_event" fields. I want to run a search hourly that will update all the fields with fresh values and in the event that a "host" is not found in the search send an alert.
Any guidance would be appreciated.
Hi @bt149,
for the lookup population search you could try something like this:
<your_search>
| stats
count
earliest(_time) AS first_event
latest(_time) AS last_event
BY host
| outputlookup your_lookup.csv
for the alert the fires eventual missing hosts, you could try:
<your_search>
| stats
count
BY host
| append [ | your_lookup | eval count=0 | fields host count]
| stats
sum(count) AS count
BY host
| where count=0
Ciao.
Giuseppe