Alerting

Combining events and agregated statistics in an alert?

unitedmarsupial
Path Finder

If I perform a search like this:

...
| stats values(host) as Hosts
| eval Hosts=mvjoin(Hosts, ",")

I'll get the comma-separated list of hosts in the Statistics-tab, and the full list of matching events in the Events-tab. So far so good.

However, any alert based on this, will only contain the list of hosts -- not the events. How can I have both? Ideally, the aggregated "event" will be the last one, so its fields can be used in the text of the e-mail (such as $result.hostList$)...

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | eventstats values(host) as Hosts
| eval Hosts=mvjoin(Hosts, ",")

View solution in original post

woodcock
Esteemed Legend

Like this:

... | eventstats values(host) as Hosts
| eval Hosts=mvjoin(Hosts, ",")
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...