If I perform a search like this:
...
| stats values(host) as Hosts
| eval Hosts=mvjoin(Hosts, ",")
I'll get the comma-separated list of hosts in the Statistics-tab, and the full list of matching events in the Events-tab. So far so good.
However, any alert based on this, will only contain the list of hosts -- not the events. How can I have both? Ideally, the aggregated "event" will be the last one, so its fields can be used in the text of the e-mail (such as $result.hostList$
)...
Like this:
... | eventstats values(host) as Hosts
| eval Hosts=mvjoin(Hosts, ",")
Like this:
... | eventstats values(host) as Hosts
| eval Hosts=mvjoin(Hosts, ",")