I have the below search set for an alert which displays all the count and i have an alert schedule with a condition to trigger when the count exceeds X (1000).
index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name
At present, whenever the condition is met (count exceeds) an email is being sent with summary of all data. I wanted to have the email listed only with the rows that has exceeded the count (1000), please help/advise
emp_initial emp_number emp_name count ABC 123 ABC J 10 ABD 124 ABD J 1005 NAD 127 NAD J 100 ...more...
emp_initial emp_number emp_name count emp_initial emp_number emp_name count ABD 124 ABD J 1005
Change your query to
index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name | where count > 1000
Then change your alert to trigger when the number of events > 0.
I have a new requirement where I would like to trigger the alert based on a count limit (>1000) but to display the related events based on a certain employee number.
For example trigger the alert when count > 1000 but display all events(including the events <1000) related to the employee number that triggered the event.
Something like index=abc sourcetype=test |stats count by empinitial,empnumber,empname| group all events by empnumber where at least one of the count for this employee number > 1000