i got the task to make 3 searches in total controllable over several systems via a csv.
The CSV looks something like this:
host, search_1, search_2, param_search_1, param_search_2, e-mail
host_test, 1, 1, 10, 20, email@example.com
the 1 in search_1 and 2 should mean that the respective search is active for this host system.
param 10 is the variable from when search_1 should trigger an alarm.
The search_1 should tell me if the host_test has not sent any events for more than 10 minutes.
search index=blue earliest=$param_search_1$ sourcetype=foo host=$host$
only it doesn't work quite the way I want it to... does anyone have any idea how I can use a CSV to parameterize the searches?
You can write search_1 and search_2 like this:
index=blue sourcetype=foo | eval search_1=1 | lookup file_name.csv host search_1 OUTPUT param_search_1, e-mail | where _time > relative_time(now(), "param_search_1") index=blue sourcetype=foo | eval search_2=1 | lookup file_name.csv host search_2 OUTPUT param_search_2, e-mail | where _time > relative_time(now(), "param_search_2")
Hey Thank you!
i have a little problem with this query. My Target is to alert here if a host dont send the data in like 10 min. So i have a list from all hosts with params, but this query only shows me the hosts how send data. I need the hosts without data und write this to a outputlookup.
Additional Information: i dont know if it help but all hosts in the list have another "param_search_1"
As Information i have a lookupfile whith recent alarms. i use this lookup file to exclude specific hosts from the search for like 30 min, thats works fine !