Combining events and agregated statistics in an alert?

[unitedmarsupial]

If I perform a search like this:

...
| stats values(host) as Hosts
| eval Hosts=mvjoin(Hosts, ",")

I'll get the comma-separated list of hosts in the Statistics-tab, and the full list of matching events in the Events-tab. So far so good.

However, any alert based on this, will only contain the list of hosts -- not the events. How can I have both? Ideally, the aggregated "event" will be the last one, so its fields can be used in the text of the e-mail (such as $result.hostList$)...

[woodcock · Accepted solution]

Like this:

... | eventstats values(host) as Hosts
| eval Hosts=mvjoin(Hosts, ",")