Alerting

How to add a column to an alert?

majilan1
Path Finder

Hi Guys,

my question is  Can priority (the regular P1/P2/P3 column) and job alias from the pw_map lookup be added to this alert as additional columns? I’ve recently started seeing some ingest issues with a few queues, and these columns would help with escalation and determining downstream impacts.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @majilan1,

if the fields to add (priority and job) are fields of the lookup you're using, you can add them to your results adding a values option for each of them to the stats command, something like this:

| stats latest(curdepth) as curdepth first(curdepth) as firstCur count as event_count sum(over_threshold) values(priority) AS Priority values(job) AS Job

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...