How to configure splunk alert email to include summary of count by source?

[Pathik]

Hello friends

I am trying to Create alert which sends me list of source when number of failure events are more then 100.

basically, let alert get triggered when total count is 100, but in email send me summary of count by source, so its very easy to find which source has a problem.

 Thanks 

[Pathik]

Any inputs for this one? thanks

[isoutamo]

Can you share your query?

[Pathik]

Sure, below is query 

index=myindex “javax.net.ssl.SSLHandshakeException” host=prod*

what I would like is when above query hits for 100 count then send me email and in that email give me count by source. So whoever has that email, its very easy for them to find which source is facing SSL issue.

 Thanks