topic Alert on table with custom email subject field value in Splunk Search

Alert on table with custom email subject field value

rmiller3 — Mon, 16 Dec 2024 18:05:18 GMT

I got an alert working "for each result" by using a query that creates the following table:

errorType count

Client 10
Credentials 50
Unknown 5

How do I set a different threshold for each result?

I tried using a custom trigger as follows and was hoping to only get an email for "client" and "credentials", but I still get all 3.

search (errorType = "Client" AND count > 8 ) OR (errorType = "Credentials" AND count > 8 ) OR (errorType = "Other" AND count >8 )

Re: Alert on table with custom email subject field value

marnall — Mon, 16 Dec 2024 19:15:31 GMT

That should work already. Could you try putting that search filter at the end of your alert search?

<yoursearch> | search (errorType = "Client" AND count > 8 ) OR (errorType = "Credentials" AND count > 8 ) OR (errorType = "Other" AND count > 8 )

Re: Alert on table with custom email subject field value

rmiller3 — Mon, 16 Dec 2024 20:41:10 GMT

That works. I was really trying to have a custom alert message with just the thresholds (since my query categorizes different error types and is fairly long, I was hoping not to put it in the alert email).

However, I think putting the whole query is fine at the end of the day, thanks!