I have a requirement to generate alerts every 15 mins if a particular condition occurs. Then I need to group data from a few server in one alert and data from other set of server in another alert.
srvrA - srvr1,srvr2
srvrB - srvr3,srvr4,srvr5
Email for srvrA:
fieldA | field B | _raw
A1 | B1 | Event1
A1 | B2 | Event2
Email for srvrB:
fieldA | fieldB | _raw
A3 | B3 | Event1
A1 | B3 | Event2
Could you please help me how to use the condition from same query and send 2 different emails.
If you add the recipients on a new column, you can configure the alert to send to $results.recipient$, and must set the alert to process a new email for each result. You can even aggregate the results with values() or list() so that each recipient only receives one alert. ( Tested on 6.5.x )
stats values(fieldA) values(fieldB) values(_raw) by recipient
on savedsearches.conf :
action.email.to = $result.recipient$
alert.digest_mode = 0
Create two alerts, both to run every 15mins looking for similar conditions to occur. Example
host=srvr1 OR host=srvr2 | stats count on alertcondition
host=srvr3 OR host=srvr4 OR host=srvr5 | stats count on alertcondition
Then setup alerts for each of these searches.