Splunk Search

Use Lookup to control searches how can i use a value at the lookupcsv as a variable for earliest=$variable$

mklhs
Path Finder

Hello together,

i got the task to make 3 searches in total controllable over several systems via a csv.

The CSV looks something like this:
host, search_1, search_2, param_search_1, param_search_2, e-mail

host_test, 1, 1, 10, 20, bla@web.de

the 1 in search_1 and 2 should mean that the respective search is active for this host system.
param 10 is the variable from when search_1 should trigger an alarm.

The search_1 should tell me if the host_test has not sent any events for more than 10 minutes.
search index=blue earliest=$param_search_1$ sourcetype=foo host=$host$

only it doesn't work quite the way I want it to... does anyone have any idea how I can use a CSV to parameterize the searches?

0 Karma

manjunathmeti
Champion

You can write search_1 and search_2 like this:

index=blue  sourcetype=foo | eval search_1=1 | lookup file_name.csv host search_1 OUTPUT param_search_1, e-mail | where _time > relative_time(now(), "param_search_1")


index=blue  sourcetype=foo | eval search_2=1 | lookup file_name.csv host search_2 OUTPUT param_search_2, e-mail | where _time > relative_time(now(), "param_search_2")
0 Karma

mklhs
Path Finder

Hey Thank you!

i have a little problem with this query. My Target is to alert here if a host dont send the data in like 10 min. So i have a list from all hosts with params, but this query only shows me the hosts how send data. I need the hosts without data und write this to a outputlookup.
Additional Information: i dont know if it help but all hosts in the list have another "param_search_1"

As Information i have a lookupfile whith recent alarms. i use this lookup file to exclude specific hosts from the search for like 30 min, thats works fine !

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...