How to edit my email alert to display the records that matches the alert condition instead a summary of all data?

[Mathanjey]

I have the below search set for an alert which displays all the count and i have an alert schedule with a condition to trigger when the count exceeds X (1000).

index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name

At present, whenever the condition is met (count exceeds) an email is being sent with summary of all data. I wanted to have the email listed only with the rows that has exceeded the count (1000), please help/advise

Current :

emp_initial  emp_number  emp_name   count

ABC          123         ABC J      10
ABD          124         ABD J      1005
NAD          127         NAD J      100
 ...more...

Expected :

emp_initial  emp_number  emp_name   count


emp_initial  emp_number  emp_name   count


ABD          124         ABD J      1005

[richgalloway]

Change your query to

index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name | where count > 1000

Then change your alert to trigger when the number of events > 0.

[Mathanjey]

I have a new requirement where I would like to trigger the alert based on a count limit (>1000) but to display the related events based on a certain employee number.

For example trigger the alert when count > 1000 but display all events(including the events <1000) related to the employee number that triggered the event.

Something like index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name| group all events by emp_number where at least one of the count for this employee number > 1000

[Mathanjey]

Thank you, it helps