Alerting

How to edit my email alert to display the records that matches the alert condition instead a summary of all data?

Mathanjey
Explorer

I have the below search set for an alert which displays all the count and i have an alert schedule with a condition to trigger when the count exceeds X (1000).

index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name

At present, whenever the condition is met (count exceeds) an email is being sent with summary of all data. I wanted to have the email listed only with the rows that has exceeded the count (1000), please help/advise

Current :

emp_initial  emp_number  emp_name   count

ABC          123         ABC J      10
ABD          124         ABD J      1005
NAD          127         NAD J      100
 ...more...

Expected :

emp_initial  emp_number  emp_name   count


emp_initial  emp_number  emp_name   count


ABD          124         ABD J      1005
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Change your query to

index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name | where count > 1000

Then change your alert to trigger when the number of events > 0.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Mathanjey
Explorer

I have a new requirement where I would like to trigger the alert based on a count limit (>1000) but to display the related events based on a certain employee number.

For example trigger the alert when count > 1000 but display all events(including the events <1000) related to the employee number that triggered the event.

Something like index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name| group all events by emp_number where at least one of the count for this employee number > 1000

0 Karma

Mathanjey
Explorer

Thank you, it helps

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.