topic Re: How to include report in alert search in Alerting

How to include report in alert search?

cbiraris — Tue, 17 Jan 2023 19:28:38 GMT

Hi Team,

I am looking for the help to send Report.

I have a scheduled report which is running every hour.

can you please advise with search query. if I create new alert and if alert trigger, scheduled report should be sent to recipients.

I am aware about the CSV/ PDF attached. looking for something like to send scheduled report as result for notification if alert triggered .

Re: How to include report in alert search

gcusello — Mon, 16 Jan 2023 10:32:18 GMT

Hi @cbiraris,

sorry: what's the difference between attach pdf/csv file to an alert or schedule a report?

what's the additional feature that you see in scheduled report?

in both cases, if you have results, you send an email containing as attachement the report.

Ciao.

Giuseppe

Re: How to include report in alert search

cbiraris — Mon, 16 Jan 2023 10:41:34 GMT

I am looking something like,

If the alert trigger with query suppose-

Index= abc sourcetype = ZXY "Error500" |stats count| where count >0

and suppose, I have a scheduled report name -- Error500 with below query

Index= abc sourcetype = ZXY "Error500" |table _time, _raw

so, if the alert trigger, then it should send out the report called Error500 ? is it possible ?

any other solution please guide me.
-----------------------------

the issue I am facing is, if use stats count it sending count only and with table it sending events logs.
and I want if it trigger it should send event log.

Thank you.

Re: How to include report in alert search

gcusello — Mon, 16 Jan 2023 10:47:40 GMT

Hi @cbiraris,

if the report that you want to send is the same of the alert (as in your example) attaching pdf/csv file, when the alert is triggered, you send the report to the recipents.

Or do you want something different?

Ciao.

Giuseppe

Re: How to include report in alert search

scelikok — Mon, 16 Jan 2023 10:49:32 GMT

Hi @cbiraris ,

You can just use

index= abc sourcetype = ZXY "Error500" |table _time, _raw

in your alert query and set a trigger condition if the result count is greater than zero. If the query returns something you will get the results.

Re: How to include report in alert search

cbiraris — Mon, 16 Jan 2023 10:49:48 GMT

Yes, I want to send different report.

Re: How to include report in alert search

gcusello — Mon, 16 Jan 2023 11:59:18 GMT

Hi @cbiraris,

the solution is the one hinted by @scelikok .

you use in the alert the search of the report and use as trigerr condition results>0.

Ciao.

Giuseppe