Alerting

Verify Splunk Alert

nebel
Communicator

Hi,

I think I have a quiet complicated request.

Lets say I have the following event, which contains

LDAP error for hostXYZ

It is a real-time search configured which is triggering the words LDAP AND error.

Now I want to check before the alert appear, if the hostXYZ is valid. So all hosts which generates the event with error and LDAP should checked against a lookup which contains a table if the host is valid.

Thank you very much

Tags (2)
0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

You'll need to extract a field for the hostname. Then you can define a lookup which has the details of valid hosts. You could also consider tags. Finally tie it all together by adding either tag= or lookup= to your search.

View solution in original post

0 Karma

dart
Splunk Employee
Splunk Employee

You'll need to extract a field for the hostname. Then you can define a lookup which has the details of valid hosts. You could also consider tags. Finally tie it all together by adding either tag= or lookup= to your search.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...