Splunk Search

Update a single field in lookup table from a search

watsm10
Communicator

Fellow Splunkers,

I've got an automatic lookup table (lookup.csv) which has a field in called Count. Every time my search runs (triggered alert) I'd like the count field to be incremented by 1, so that I can see how many times the alert has been triggered previously and include this in the alert email as a field from the lookup table.

I've tried this, but it hasn't worked for me:
| eval Count=Count+1 | outputlookup Count lookup.csv

Do I need to run a subsearch? I'm not entirely sure how to do it.

How would I go about doing this?

Many thanks.

0 Karma

sowings
Splunk Employee
Splunk Employee

You're so close!

Begin with | inputlookup lookup.csv then do your | eval | outputlookup. I utilize this method quite frequently to keep CSVs well groomed.

0 Karma

watsm10
Communicator

Here is my search:
sourcetype="production_env" | chart eval(round(((count(eval(Status="Error"))/count)*100),2)) as "FailureRate", values(Threshold) as "Threshold", values(AlertStatus) as "AlertStatus", values(FailCount) as "Total Alerts" by ServiceNameLookup | eval AlertStatus = if(FailureRate>Threshold, "Failure rate over ".Threshold."% for the last 15 mins","OK") | rename ServiceNameLookup as "Service Name", FailureRate as "Failure Rate"

It invokes the lookup table with a list of service names and thresholds, then compares the failure rate against the threshold. How would adapt your method?

sowings
Splunk Employee
Splunk Employee

If it's part of an alerting search, then I'd say "yes", but to be sure, I'd have to know what the rest of the search is doing.

If the contents of the lookup table drive the alerting search (i.e. you start with |inputlookup then the result set will include count, and you can output that to update the count. But if the count lookup is completely separate from the alerting results, (that is, the lookup contains only the count) you'll have to tweak the search somewhat.

0 Karma

watsm10
Communicator

Thanks, so shall I just pipe this onto the end of my search? Or have this as a subsearch which runs and updates it separately?

Many thanks.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...