i got the task to make 3 searches in total controllable over several systems via a csv.
The CSV looks something like this:
host, search1, search2, paramsearch1, paramsearch2, e-mail
host_test, 1, 1, 10, 20, email@example.com
the 1 in search1 and 2 should mean that the respective search is active for this host system.
param 10 is the variable from when search1 should trigger an alarm.
The search1 should tell me if the hosttest has not sent any events for more than 10 minutes.
search index=blue earliest=$paramsearch1$ sourcetype=foo host=$host$
only it doesn't work quite the way I want it to... does anyone have any idea how I can use a CSV to parameterize the searches?
You can write search1 and search2 like this:
index=blue sourcetype=foo | eval search_1=1 | lookup file_name.csv host search_1 OUTPUT param_search_1, e-mail | where _time > relative_time(now(), "param_search_1") index=blue sourcetype=foo | eval search_2=1 | lookup file_name.csv host search_2 OUTPUT param_search_2, e-mail | where _time > relative_time(now(), "param_search_2")
Hey Thank you!
i have a little problem with this query. My Target is to alert here if a host dont send the data in like 10 min. So i have a list from all hosts with params, but this query only shows me the hosts how send data. I need the hosts without data und write this to a outputlookup.
Additional Information: i dont know if it help but all hosts in the list have another "paramsearch1"
As Information i have a lookupfile whith recent alarms. i use this lookup file to exclude specific hosts from the search for like 30 min, thats works fine !