I am looking for the help to send Report.
I have a scheduled report which is running every hour.
can you please advise with search query. if I create new alert and if alert trigger, scheduled report should be sent to recipients.
I am aware about the CSV/ PDF attached. looking for something like to send scheduled report as result for notification if alert triggered .
Hi @cbiraris ,
You can just use
index= abc sourcetype = ZXY "Error500" |table _time, _raw
in your alert query and set a trigger condition if the result count is greater than zero. If the query returns something you will get the results.
sorry: what's the difference between attach pdf/csv file to an alert or schedule a report?
what's the additional feature that you see in scheduled report?
in both cases, if you have results, you send an email containing as attachement the report.
I am looking something like,
If the alert trigger with query suppose-
Index= abc sourcetype = ZXY "Error500" |stats count| where count >0
and suppose, I have a scheduled report name -- Error500 with below query
Index= abc sourcetype = ZXY "Error500" |table _time, _raw
so, if the alert trigger, then it should send out the report called Error500 ? is it possible ?
any other solution please guide me.
the issue I am facing is, if use stats count it sending count only and with table it sending events logs.
and I want if it trigger it should send event log.
if the report that you want to send is the same of the alert (as in your example) attaching pdf/csv file, when the alert is triggered, you send the report to the recipents.
Or do you want something different?