- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- How do I configure a scheduled alert to send an em...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do I configure a scheduled alert to send an email ONLY when there is an update to a lookup table?
I have the lastModifiedTime from the lookup table using the rest command, but can't figure out how to define the trigger condition when I select Custom. I've tried search count >0 AND lastModifiedTime < (now() - 900) with no success.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello there, try adding this eval at the end of your query, | eval action_var=if(lastModifiedTime < (now() - 900), "1", "0") then add this as the custom condition where action_var=="1"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I verified the value is set for action_var, but where action_var=="1" doesn't cause the email to generate. I also tried setting the value without the quotes (data type?) and updating where action_var==1, with no success. Either the email generates every time the alert runs or never (if I select Throttle with number of results greater than 0). I'm using a lookup table that houses issues for two groups. My goal is to generate an email when a new issue is added, based on severity. Reminders going out based on status every 4 hours for severity and MWF at 8 am for non priority work fine.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
action_var="1" does what I need, but I'm finding emails are generated when there are no results. I need to suppress these empty emails using the custom condition. Adding action_var="1" count > 0 causes the alert to not send emails when there are records. I would think the count would be exposed for my use. What am I missing?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Trigger condition should be action_var="1" AND count > 0 you are missing the boolean operator that could be the reason why its not alerting after the change.
Do you mind sharing your query and alert configuration ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This has been resolved. The problem was I didn't have Count in the columns returned. After adding the count, it works properly. I had tried using AND previously, but without the count, the condition was never met. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oh I see. Good job!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
can you post full query.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
