Alerting

How to edit my email alert to display the records that matches the alert condition instead a summary of all data?

Mathanjey
Explorer

I have the below search set for an alert which displays all the count and i have an alert schedule with a condition to trigger when the count exceeds X (1000).

index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name

At present, whenever the condition is met (count exceeds) an email is being sent with summary of all data. I wanted to have the email listed only with the rows that has exceeded the count (1000), please help/advise

Current :

emp_initial  emp_number  emp_name   count

ABC          123         ABC J      10
ABD          124         ABD J      1005
NAD          127         NAD J      100
 ...more...

Expected :

emp_initial  emp_number  emp_name   count


emp_initial  emp_number  emp_name   count


ABD          124         ABD J      1005
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Change your query to

index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name | where count > 1000

Then change your alert to trigger when the number of events > 0.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Mathanjey
Explorer

I have a new requirement where I would like to trigger the alert based on a count limit (>1000) but to display the related events based on a certain employee number.

For example trigger the alert when count > 1000 but display all events(including the events <1000) related to the employee number that triggered the event.

Something like index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name| group all events by emp_number where at least one of the count for this employee number > 1000

0 Karma

Mathanjey
Explorer

Thank you, it helps

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...