Splunk Search
Highlighted

Use Lookup to control searches how can i use a value at the lookupcsv as a variable for earliest=$variable$

Path Finder

Hello together,

i got the task to make 3 searches in total controllable over several systems via a csv.

The CSV looks something like this:
host, search1, search2, paramsearch1, paramsearch2, e-mail

host_test, 1, 1, 10, 20, bla@web.de

the 1 in search1 and 2 should mean that the respective search is active for this host system.
param 10 is the variable from when search
1 should trigger an alarm.

The search1 should tell me if the hosttest has not sent any events for more than 10 minutes.
search index=blue earliest=$paramsearch1$ sourcetype=foo host=$host$

only it doesn't work quite the way I want it to... does anyone have any idea how I can use a CSV to parameterize the searches?

0 Karma
Highlighted

Re: Use Lookup to control searches how can i use a value at the lookupcsv as a variable for earliest=$variable$

Influencer

You can write search1 and search2 like this:

index=blue  sourcetype=foo | eval search_1=1 | lookup file_name.csv host search_1 OUTPUT param_search_1, e-mail | where _time > relative_time(now(), "param_search_1")


index=blue  sourcetype=foo | eval search_2=1 | lookup file_name.csv host search_2 OUTPUT param_search_2, e-mail | where _time > relative_time(now(), "param_search_2")
0 Karma
Highlighted

Re: Use Lookup to control searches how can i use a value at the lookupcsv as a variable for earliest=$variable$

Path Finder

Hey Thank you!

i have a little problem with this query. My Target is to alert here if a host dont send the data in like 10 min. So i have a list from all hosts with params, but this query only shows me the hosts how send data. I need the hosts without data und write this to a outputlookup.
Additional Information: i dont know if it help but all hosts in the list have another "paramsearch1"

As Information i have a lookupfile whith recent alarms. i use this lookup file to exclude specific hosts from the search for like 30 min, thats works fine !

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.