topic Re: Emailing selected Fields with Alert in Splunk Search

Emailing selected Fields with Alert

aniketb — Fri, 27 Jul 2012 18:37:37 GMT

Hi,

I'm trying to create an alert which emails me just the "host", "sourcetype" and "source" in the email.
I know we have an option of "Include results in email" but this alert flags off after 1000 events and I don't need any info from the log, I just need to look at those 3 fields.

Any possible way to do this?

Re: Emailing selected Fields with Alert

Kate_Lawrence-G — Fri, 27 Jul 2012 20:27:14 GMT

I think the best way to accomplish that is to make your alert condition not based on your results but instead a custom condition that way you can modify your results to be the host/sourcetype/source and provide those in your email instead.

Re: Emailing selected Fields with Alert

aniketb — Mon, 30 Jul 2012 17:37:28 GMT

How do you shortlist them in search? e.g. i tried this method on finding the string "invalid password". I set an alert on
"invalid password" | fields + host,source,sourcetype
It gave me an email just with the alert name and the link pointed back again to the whole list of logs.

Re: Emailing selected Fields with Alert

Kate_Lawrence-G — Mon, 30 Jul 2012 18:40:44 GMT

I was thinking something more along the lines of this:

sourcetype= "A string!" | eval error="A string!" | stats c(error) as e, values(host),values(source) by sourcetype | where e > 0

You can either keep the where in the search and alert when events are found OR you can take it out and put it in as the conditional alerting custom condition.

In this context it will send you the host/source and sourcetype information as the results of the search.