How can I send a list of items to an alert?

[voninski]

I have the following search:

index=* sourcetype=HAI  | transaction name=grouped_events | search currentStatusText != "" | stats first(currentStatusText) as DisplayValue by name | search DisplayValue = "[NOT READY]"  The attached screenshot show you my results.

NOT READY means that something is open in my house (the search is against my home security system)

I would like to run this search on a scheduled basis and send the list of 'names based on 'not ready' .

How can I send a list of items like this to an alert? Do I have to build a concatenated string? Or is there a way to send a list like this to an alert?

I have not yet been able to find an example to do this.

Thank you.

Rich

[somesoni2 · Accepted solution]

Use info from this link to setup your search as alert

http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Definescheduledalerts

Use this link to setup the Email notification and make sure to configure 'Include' with option "Inline results formatted as a table, raw events, or CSV file"

http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Emailnotification

[voninski]

Inline table doesnt work well with cellphone text messages. I need to just provide the names of all items to the cellphone in a text message.

If it was just an email - inline table would work fine.

Any idea of how to do this for a cellphone. As i was thinking - maybe building a concatenated string?

[somesoni2]

You can merge all name into one string like this

index=* sourcetype=HAI | transaction name=grouped_events | search currentStatusText != "" | stats first(currentStatusText) as DisplayValue by name | search DisplayValue = "[NOT READY]" | stats values(name) as name delim="," | nomv name 

[voninski]

B-I-N-G-O!! Thats exactly what i'm looking for!!

TY

[ppablo]

Glad you found your answer 🙂 Don't forget to upvote @somesoni's comment for helping you out.

Cheers!

Patrick

[voninski]

I would like to send this as an alert to a cellphone via text message. Which is why the inline table doesn't work well.