How to include a text message in an alert?

[raghavprakasam]

Hi ,

I have used '$result.message$' to print a specific field in the log over the email.But this reference prints the message 2 times.I have totally 11 occurrences for the search string at the same time.I have triggered the alert after 10th occurrence.I just want to print this message only once,Is there any way?

[DavidHourani]

Hi @raghavprakasam,

I see multiple solutions for your problems :

1- You can use the dedup command to drop the number of results to one.
2- You can use the stats count by youreventcommand and change the condition to trigger on the count >10 instead of counting the events with the alert.
3- You can leverage the alert throttle to reduce the total number of message you receive.

Let me know the query you are using and I can help you fix it to reduce the number of events if you're not able to with the above.

Cheers,
David

[richgalloway]

Converted from an answer to a question.