I have created an alert and setup email for it but its not working

[shreyasathavale]

I have created the following alert (using UI or Alert Manager) and have set alert mail on condition warning > 0 which is working fine.

earliest=-2h environment=Test Severity=Error|stats count as warning by Message,_time |sort _time desc

Now i want the mail format to be in tabular form so i modified the search to below with same alert condition:

earliest=-2h environment=Test Severity=Error|stats count as warning by Message,_time |sort _time desc|table Message,_time

But the 2nd search is not generating an alert mail.
Any idea on this will be helpful

[stephanefotso · Accepted solution]

If your condition is warning > 0 , warning must be one of your table outputs. Try this and let me know

earliest=-2h environment=Test Severity=Error|stats count as warning by Message,_time |sort _time desc|table Message,_time, warning

[shreyasathavale]

Thanks..will try it..

[stephanefotso]

ok. Iet me know if any issue.

[shreyasathavale]

Had tried that too previously but was not working. Created the same alert using savedsearch and it worked 🙂

[shreyasathavale]

search is returning values but still not sending an email.. 😞 rather have got a blank mail without results in mail

[stephanefotso]

ok now, at the alert action screen, include an inline Table .