Can I trigger an alert based on part of one of several lines generated by a search?

[Gawker]

Greetings.

I've a search to determine the number of events per IP. The resulting output looks like the following, where the first column is the IP and the 2nd column being the number (count) of events:

123.456.789.1 35
123.456.789.2 0
123.456.789.3 257
123.456.789.4 153
...

I would like to set up an alert that checks for any IP with an even count that exceeds 200. Ideally the alert would only include information for that particular entry.

Thank you.

[damiensurat · Accepted solution]

Hi Gawker, It would be easier if you provided your search, but in essence all you need to do following your search is :

"your search" | search IPCount > 200

In the above search I am using the IPCount field as an alias for the field you are using for "number (count) of events". An example of how I would do it in a search:

index=foo source=bar | fields ip | stats count(ip) as IPEventCount by ip | search IPEventCount > 200

Save your search as an alert (you can see save button at the top of the search screen)

Assuming you are using email for alerting:
Set your alert schedule and under Trigger Conditions:
Trigger Alert When "Number of Results" is "greater than" 0

Trigger Actions:
Add Action
Send Email
Fill in the blanks....
Check: Inline Table

Hope this helps

[Gawker]

Thank you for the reply, damiensurat.

I've used your valuable input to modify my query and now have an alert in place.