Use Lookup to control searches how can i use a value at the lookupcsv as a variable for earliest=$variable$

[mklhs]

Hello together,

i got the task to make 3 searches in total controllable over several systems via a csv.

The CSV looks something like this:
host, search_1, search_2, param_search_1, param_search_2, e-mail

host_test, 1, 1, 10, 20, bla@web.de

the 1 in search_1 and 2 should mean that the respective search is active for this host system.
param 10 is the variable from when search_1 should trigger an alarm.

The search_1 should tell me if the host_test has not sent any events for more than 10 minutes.
search index=blue earliest=$param_search_1$ sourcetype=foo host=$host$

only it doesn't work quite the way I want it to... does anyone have any idea how I can use a CSV to parameterize the searches?

[manjunathmeti]

You can write search_1 and search_2 like this:

index=blue  sourcetype=foo | eval search_1=1 | lookup file_name.csv host search_1 OUTPUT param_search_1, e-mail | where _time > relative_time(now(), "param_search_1")


index=blue  sourcetype=foo | eval search_2=1 | lookup file_name.csv host search_2 OUTPUT param_search_2, e-mail | where _time > relative_time(now(), "param_search_2")

[mklhs]

Hey Thank you!

i have a little problem with this query. My Target is to alert here if a host dont send the data in like 10 min. So i have a list from all hosts with params, but this query only shows me the hosts how send data. I need the hosts without data und write this to a outputlookup.
Additional Information: i dont know if it help but all hosts in the list have another "param_search_1"

As Information i have a lookupfile whith recent alarms. i use this lookup file to exclude specific hosts from the search for like 30 min, thats works fine !