Alerting

How can I get the matching events count into an alert message?

splunk_skuehne
Engager

Hello,

I created an alert, if a search brings up less than 1,000 results. How can I add the exact number of results to the alert message?
Currently the trigger is "Number of results" "is less than" 1,000. When I mark "Inline Table" I get all results in the mail, but not the count.

How can I get the count of all events into the alert mail?
Thank you!

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Take a look at the documentation here. $job.resultCount$ is what you are looking for, I think.

View solution in original post

elliotproebstel
Champion

In the email, you can reference the token $job.resultCount$, which will contain the number of results returned by the job.
For information about other tokens you can use in the email, here is the documentation:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Alert/EmailNotificationTokens

s2_splunk
Splunk Employee
Splunk Employee

Take a look at the documentation here. $job.resultCount$ is what you are looking for, I think.

Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...