Alerting

How to edit my email alert to display the records that matches the alert condition instead a summary of all data?

Mathanjey
Explorer

I have the below search set for an alert which displays all the count and i have an alert schedule with a condition to trigger when the count exceeds X (1000).

index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name

At present, whenever the condition is met (count exceeds) an email is being sent with summary of all data. I wanted to have the email listed only with the rows that has exceeded the count (1000), please help/advise

Current :

emp_initial  emp_number  emp_name   count

ABC          123         ABC J      10
ABD          124         ABD J      1005
NAD          127         NAD J      100
 ...more...

Expected :

emp_initial  emp_number  emp_name   count


emp_initial  emp_number  emp_name   count


ABD          124         ABD J      1005
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Change your query to

index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name | where count > 1000

Then change your alert to trigger when the number of events > 0.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Mathanjey
Explorer

I have a new requirement where I would like to trigger the alert based on a count limit (>1000) but to display the related events based on a certain employee number.

For example trigger the alert when count > 1000 but display all events(including the events <1000) related to the employee number that triggered the event.

Something like index=abc sourcetype=test |stats count by emp_initial,emp_number,emp_name| group all events by emp_number where at least one of the count for this employee number > 1000

0 Karma

Mathanjey
Explorer

Thank you, it helps

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...