https://community.splunk.com/t5/Splunk-Search/Fire-an-alert-when-count-of-a-particular-value-in-one-column-is/m-p/221206#M65015 <P>You should be able by triggering results only once instead of by result and also including an inline table in your email.</P> <P>See pictures below and hope that helps.</P> <P><IMG src="https://s10.postimg.org/ltzz4u6p5/Screen_Shot_2016_08_11_at_10_55_35.png" alt="alt text" /></P> <P><IMG src="https://s9.postimg.org/7eweblan3/Screen_Shot_2016_08_11_at_10_55_01.png" alt="alt text" /></P> Thu, 11 Aug 2016 09:59:25 GMT javiergn 2016-08-11T09:59:25Z https://community.splunk.com/t5/Splunk-Search/Fire-an-alert-when-count-of-a-particular-value-in-one-column-is/m-p/221203#M65012 <P>Hello,<BR /> I have a query like so:<BR /> source=“some-source.log” MySearchQuery | stats count by user, host_name</P> <P>which produces results like:</P> <PRE><CODE>user host_name count user1 host_name1 5 user2 host_name2 6 user1 host_name3 9 user3 host_name1 3 user3 host_name3 4 </CODE></PRE> <P>My question is: how can I write a query to fire an alert when the <STRONG><EM>sum of count</EM></STRONG> for any user in the above table is greater than 10, e.g user1 here.</P> Wed, 10 Aug 2016 06:56:19 GMT https://community.splunk.com/t5/Splunk-Search/Fire-an-alert-when-count-of-a-particular-value-in-one-column-is/m-p/221203#M65012 Vettori 2016-08-10T06:56:19Z https://community.splunk.com/t5/Splunk-Search/Fire-an-alert-when-count-of-a-particular-value-in-one-column-is/m-p/221204#M65013 <P>Option 1:</P> <PRE><CODE>source=“some-source.log” MySearchQuery | stats count by user, host_name | eventstats sum(count) as total_user by user | where total_user &gt; 10 </CODE></PRE> <P>Then click on save as &gt; alert</P> <P>Option 2:</P> <PRE><CODE>source=“some-source.log” MySearchQuery | stats count by user, host_name | stats sum(count) as total_user, values(host_name) as host_name by user | where total_user &gt; 10 </CODE></PRE> <P>Then click on save as &gt; alert</P> <P>Hope that helps.</P> <P>Regards,<BR /> J</P> Wed, 10 Aug 2016 13:53:10 GMT https://community.splunk.com/t5/Splunk-Search/Fire-an-alert-when-count-of-a-particular-value-in-one-column-is/m-p/221204#M65013 javiergn 2016-08-10T13:53:10Z https://community.splunk.com/t5/Splunk-Search/Fire-an-alert-when-count-of-a-particular-value-in-one-column-is/m-p/221205#M65014 <P>Thanks, accepted the answer. Just another question related to the table in question. Is there a way to attach all of the users' list in the email? Currently, I am using $result.user$ which only picks up the first user.</P> Thu, 11 Aug 2016 08:59:31 GMT https://community.splunk.com/t5/Splunk-Search/Fire-an-alert-when-count-of-a-particular-value-in-one-column-is/m-p/221205#M65014 Vettori 2016-08-11T08:59:31Z https://community.splunk.com/t5/Splunk-Search/Fire-an-alert-when-count-of-a-particular-value-in-one-column-is/m-p/221206#M65015 <P>You should be able by triggering results only once instead of by result and also including an inline table in your email.</P> <P>See pictures below and hope that helps.</P> <P><IMG src="https://s10.postimg.org/ltzz4u6p5/Screen_Shot_2016_08_11_at_10_55_35.png" alt="alt text" /></P> <P><IMG src="https://s9.postimg.org/7eweblan3/Screen_Shot_2016_08_11_at_10_55_01.png" alt="alt text" /></P> Thu, 11 Aug 2016 09:59:25 GMT https://community.splunk.com/t5/Splunk-Search/Fire-an-alert-when-count-of-a-particular-value-in-one-column-is/m-p/221206#M65015 javiergn 2016-08-11T09:59:25Z https://community.splunk.com/t5/Splunk-Search/Fire-an-alert-when-count-of-a-particular-value-in-one-column-is/m-p/221207#M65016 <P>Works so well. Thanks.</P> Thu, 11 Aug 2016 11:03:03 GMT https://community.splunk.com/t5/Splunk-Search/Fire-an-alert-when-count-of-a-particular-value-in-one-column-is/m-p/221207#M65016 Vettori 2016-08-11T11:03:03Z