Alerting

Combining events and agregated statistics in an alert?

unitedmarsupial
Path Finder

If I perform a search like this:

...
| stats values(host) as Hosts
| eval Hosts=mvjoin(Hosts, ",")

I'll get the comma-separated list of hosts in the Statistics-tab, and the full list of matching events in the Events-tab. So far so good.

However, any alert based on this, will only contain the list of hosts -- not the events. How can I have both? Ideally, the aggregated "event" will be the last one, so its fields can be used in the text of the e-mail (such as $result.hostList$)...

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | eventstats values(host) as Hosts
| eval Hosts=mvjoin(Hosts, ",")

View solution in original post

woodcock
Esteemed Legend

Like this:

... | eventstats values(host) as Hosts
| eval Hosts=mvjoin(Hosts, ",")

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.