Alert Manager App - How to create a incident per result (row)

peterschloenske — Sun, 07 Mar 2021 12:01:02 GMT

Hi,

I'm trying to create an incident within the Alert Manager App per result row of the generating search.
Let's say I have a search "Failed transactions by host". The result table looks like this:

_time	host	failed_transactions
2021-03-07 12:55:01	host_a	100
2021-03-07 12:55:01	host_b	200

It is easy to create an incident for "failed transactions" in general. But I would like to create incidents per host, that can be tracked individually. I tried to achieve it by using $result.host$ as the title, but this did not work.

Does anyone know whether this is possible?

Re: Alert Manager App - How to create a incident per result (row)

peterschloenske — Mon, 08 Mar 2021 12:10:10 GMT

I did not recognize that I saved it as report instead as an alert. As an alert, I can set "trigger for each result" to get it work

topic Alert Manager App - How to create a incident per result (row) in Alerting

Alert Manager App - How to create a incident per result (row)

Re: Alert Manager App - How to create a incident per result (row)