Is any way to include logs/events in Alert email?

[summerura]

Hi Splunkers!

i set the alert with "upload". which means someone upload something, i get email.
The email is only included last event. But i want to get email with a few previous events.

for example, if logs are like this

[date:02.08.2019] [user:haha] [c:login]
[date:02.08.2019] [user:haha] [c:download]
[date:02.08.2019] [user:haha] [c:edit]
[date:02.08.2019] [user:haha] [c:upload]

i got email only with last line which is "[date:02.08.2019] [user:haha] [c:upload]".
But i want to get alert email not only event but also previous events.
which is "[date:02.08.2019] [user:haha] [c:edit], [date:02.08.2019] [user:haha] [c:upload] " or even last 3 events.

is it possible?

Thanks for reading

[woodcock]

Everybody is very confused at this point. You should probably back ALL the way up and start over. What do your events look like? What is your search SPL? What are your alert settings?

[summerura]

Hi, @woodcock
Thanks for help!

i think we understood wrong eachother. i want to explain again...

We have "audit_log" from our software in splunk and the data are updated every second.
There are sometimes log-in error if somebody give wrong password or when the server has problem.
and we set the email-alert when somebody have log-in error.
BUT we want to also include the last audit_log line in email-alert.
My question was whether it is possible or not...
Do you have any idea?

Thanks

[woodcock]

Put your threshold into the SPL like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="blahblah" AND host="blahblah" AND c=upload
| eventstats count(or other aggregation function here) AS trigger BY host and/or maybe other fields here
| where trigger > YourThresholdHere

Then set your alert for Number of events and Is greater than 0 and click the boxes to include all events.

[woodcock]

You can setup the alert to send all events and then end your alerting search SPL with ... | head 5

[summerura]

I tried

host="blahblah" AND c=upload AND sourcetype="blahblah"

| head 5

but it's nor working

[summerura]

makes sense. Thanks, but how can I call all events?