Alerting
Highlighted

How to edit my email alert to display the records that matches the alert condition instead a summary of all data?

Explorer

I have the below search set for an alert which displays all the count and i have an alert schedule with a condition to trigger when the count exceeds X (1000).

index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name

At present, whenever the condition is met (count exceeds) an email is being sent with summary of all data. I wanted to have the email listed only with the rows that has exceeded the count (1000), please help/advise

Current :

emp_initial  emp_number  emp_name   count

ABC          123         ABC J      10
ABD          124         ABD J      1005
NAD          127         NAD J      100
 ...more...

Expected :

emp_initial  emp_number  emp_name   count


emp_initial  emp_number  emp_name   count


ABD          124         ABD J      1005
0 Karma
Highlighted

Re: How to edit my email alert to display the records that matches the alert condition instead a summary of all data?

SplunkTrust
SplunkTrust

Change your query to

index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name | where count > 1000

Then change your alert to trigger when the number of events > 0.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to edit my email alert to display the records that matches the alert condition instead a summary of all data?

Explorer

Thank you, it helps

0 Karma
Highlighted

Re: How to edit my email alert to display the records that matches the alert condition instead a summary of all data?

Explorer

I have a new requirement where I would like to trigger the alert based on a count limit (>1000) but to display the related events based on a certain employee number.

For example trigger the alert when count > 1000 but display all events(including the events <1000) related to the employee number that triggered the event.

Something like index=abc sourcetype=test |stats count by empinitial,empnumber,empname| group all events by empnumber where at least one of the count for this employee number > 1000

0 Karma