topic Re: Is it possible to create an alert that does summary indexing and sends an email? in Knowledge Management

Is it possible to create an alert that does summary indexing and sends an email?

morethanyell — Fri, 26 Oct 2018 15:01:04 GMT

We got a working solution using saved searches (summary indexer and alert sending email) that does something like this:

# Name: our_good_saved_search
# Schedule: runs every 30 minutes
# Type: Summary Indexing Saved Search
# Description: Basically, what below does is it'll get logs from a raw index, put them in a summary index if the same logs aren't in the summary index yet

index=our_raw_index sourcetype=our_logs earliest=-5d@w1
| dedup Some, Unique, Fields,
| table Some, Unique, Fields, Just, Another, Column
| join type=left Some, Unique, Fields
    [ search index=our_summary_index source=our_good_saved_search earliest=-5d@w1
    | eval Excluder = 1 ]
| where isnull(Excluder)
| eval _time = now()
| table _time, Some, Unique, Fields, Just, Another, Column

# Name: our_good_email_sender
# Schedule: 1,31 * * * *
# Type: Alert With Send Email Action
# Description: Basically, what below does is when it detects new items, it'll send emails for each of them

index=our_summary_index source=our_good_saved_search earliest=-29min@min-1s@s
| table _time, Some, Unique, Fields, Just, Another, Column

We find it redundant since both are types of saved searches. We're wondering if it's possible that the whole thing can be done by just one alert basically like this:

index=our_raw_index sourcetype=our_logs earliest=-5d@w1
| dedup Some, Unique, Fields,
| table Some, Unique, Fields, Just, Another, Column
| join type=left Some, Unique, Fields
    [ search index=our_summary_index source=our_good_email_sender earliest=-5d@w1
    | eval Excluder = 1 ]
| where isnull(Excluder)
| eval _time = now()
| table _time, Some, Unique, Fields, Just, Another, Column
| summaryindex ...

Theoretically, the above code is an alert that would

Summary index its result
Send an email for each result.

I've already tried adding the action_summary.index=1 and action.summary_index._name = our_summary_index configs but they're not working.

If this is possible, please advise on what I am missing.

Thanks in advance.

Re: Is it possible to create an alert that does summary indexing and sends an email?

Vijeta — Fri, 26 Oct 2018 16:23:21 GMT

you can use collect command for summary indexing your search results and sendemail command for sending the email of search result.

Re: Is it possible to create an alert that does summary indexing and sends an email?

woodcock — Thu, 08 Nov 2018 01:54:23 GMT

You need not use the alert actions; you can do the same thing with SPL. You can use collect to send data to a summary index and you can use sendemail to send results by email.

Re: Is it possible to create an alert that does summary indexing and sends an email?

morethanyell — Fri, 09 Nov 2018 08:06:15 GMT

Hi. Thanks for the "collect".. It's working. However, I can't get to pass a random string to the "file" argument. It says that we need to do file=randomstring_event.stash.

How do you pass a random, say _time, there?

Re: Is it possible to create an alert that does summary indexing and sends an email?

woodcock — Sat, 10 Nov 2018 23:31:11 GMT

Use marker and be aware that there has to be a comma and a space between the key=value pairs and if the value contains spaces or commas, it needs to be escape quoted. The stream should have an | addinfo included for the manual population of the index (backfill):

... Your Search Here
| addinfo
| collect index=mysummary marker="_time=foo, summary_span=3600, summary_method=bucket, search_name=\"vpn starts and stops\""