Alerting

Joining searches into one report/alert

dsmeerkat
Explorer

Hi all!! I need some help....I currently have a search that looks at inex volume by pool and that is emailed out daily:

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by pool | convert ctime(_time) as Day | rename auto_generated_pool_enterprise AS Total | table Day, Total

And this works well....I was wondering if in the email I could add these two searches as seperate tables contained in the one email alert? Or would they have to be seperate emails?

The two I want to add are:

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=false

And:

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by i useother=false 
0 Karma

lukejadamec
Super Champion

You actually want to create a dashboard that has all three searches, and schedule the dashboard for PDF delivery.

dsmeerkat
Explorer

NICE!!! Thanks very much!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...