topic Re: Changing data shown in email alert in Alerting

Changing data shown in email alert

robK123 — Fri, 28 Dec 2012 09:14:22 GMT

I run this search
source="secure" sshd "pam_ldap: error trying to bind as user"|top uid limit=10

which then shows me the top 10 login failures and how many failures they had but I also want it to display the host that failures where on so they are included in the email but I am not sure how to do this?

Re: Changing data shown in email alert

jonuwz — Fri, 28 Dec 2012 11:04:27 GMT

Might be easier to not use the 'top' command to get this information.

i.e.

source="secure" sshd "pam_ldap: error trying to bind as user"
| stats count values(host) as hosts by uid | sort - count | head 10

Update :

here's a search that going to return data - its the same concept..

index=_internal sourcetype=splunkd earliest=-1h@h latest=@h | bin _time span=15m 
| stats count values(_time) as times by group | sort - count | head 10

Re: Changing data shown in email alert

robK123 — Fri, 28 Dec 2012 12:11:15 GMT

Thanks but when I run that it returns no results.

Re: Changing data shown in email alert

jonuwz — Fri, 28 Dec 2012 13:13:09 GMT

In that case there's no data returned by the 1st part of the search. See update