https://community.splunk.com/t5/Alerting/Combining-events-and-agregated-statistics-in-an-alert/m-p/471302#M8352 <P>If I perform a search like this:</P> <PRE><CODE>... | stats values(host) as Hosts | eval Hosts=mvjoin(Hosts, ",") </CODE></PRE> <P>I'll get the comma-separated list of hosts in the Statistics-tab, and the full list of matching events in the Events-tab. So far so good.</P> <P>However, any alert based on this, will <EM>only</EM> contain the list of hosts -- not the events. How can I have both? Ideally, the aggregated "event" will be the last one, so its fields can be used in the text of the e-mail (such as <CODE>$result.hostList$</CODE>)...</P> Fri, 20 Dec 2019 02:35:41 GMT unitedmarsupial 2019-12-20T02:35:41Z https://community.splunk.com/t5/Alerting/Combining-events-and-agregated-statistics-in-an-alert/m-p/471302#M8352 <P>If I perform a search like this:</P> <PRE><CODE>... | stats values(host) as Hosts | eval Hosts=mvjoin(Hosts, ",") </CODE></PRE> <P>I'll get the comma-separated list of hosts in the Statistics-tab, and the full list of matching events in the Events-tab. So far so good.</P> <P>However, any alert based on this, will <EM>only</EM> contain the list of hosts -- not the events. How can I have both? Ideally, the aggregated "event" will be the last one, so its fields can be used in the text of the e-mail (such as <CODE>$result.hostList$</CODE>)...</P> Fri, 20 Dec 2019 02:35:41 GMT https://community.splunk.com/t5/Alerting/Combining-events-and-agregated-statistics-in-an-alert/m-p/471302#M8352 unitedmarsupial 2019-12-20T02:35:41Z https://community.splunk.com/t5/Alerting/Combining-events-and-agregated-statistics-in-an-alert/m-p/471303#M8353 <P>Like this:</P> <PRE><CODE>... | eventstats values(host) as Hosts | eval Hosts=mvjoin(Hosts, ",") </CODE></PRE> Fri, 20 Dec 2019 11:08:30 GMT https://community.splunk.com/t5/Alerting/Combining-events-and-agregated-statistics-in-an-alert/m-p/471303#M8353 woodcock 2019-12-20T11:08:30Z