Alerting

Only One Results are part of the email notifications- How do I get multiple results?

Nithianandan
Observer

Hello Friends,

Basesearch | Table workflowname runid count status.

When it's serached,results will be as mentioned below 

workflowname runid count status

Workflowname1 123    5      Completed

Workflowname2 456    7      Paused

Workflowname1 789    8      Completed

Workflowname3 1011  4      Running

Workflowname1 1013  4      Running

Workflowname2 432    8      Completed

I have configured an alert,to trigger when the result are greater than 0. Which means all the above mentioned results will be part of the email alert notification. When I use the suppress option by mentioning the fieldname as workflowname only one result been recieved as a part of email alert notifications. 

 

Example how now the email is received 

Email received for the Workflowname1

workflowname runid count status

Workflowname1 123    5      Completed

 

Email received for the Workflowname2

workflowname runid count status

Workflowname2 456    7      Paused

 

Can someone help out here with different email alert all the results for the unique workflowname should be triggered.

Excepted one - 

One mail for the workflowname1

workflowname runid count status

Workflowname1 123    5      Completed

Workflowname1 789    8      Completed

Workflowname1 1013  4      Running

 

Other email for the workflowname2

workflowname runid count status

Workflowname2 456    7      Paused

Workflowname2 432    8      Completed

 

Separate email for the workflowname3

workflowname runid count status

Workflowname3 1011  4      Running

 

Looking forward to hear inorder to achieve the above result 

 

Thanks for the support.

Labels (4)
0 Karma

jdunlea
Contributor

A few things to note here:

 

  1. When you configure the alert to trigger "when the result are greater than 0" this means that it will trigger as long as there is at least one result returned from the search. This is NOT looking at your field called "count". In your example, the alert fires and has 6 results, and hence the condition for "when the results are greater than 0" will be triggered.
  2. Unfortunately, if you are suppressing based on the workflowname, then you cannot have 3 separate emails triggered the way you want, using only 1 alert. Because as soon as Splunk sees a THE FIRST result for WorkFlow1, then it will only trigger an email for that result, before checking for other values for workflowname. 

 

You have two options in this situation:

 

1. Create 3 different alerts. Each one will look for a specific workflowname and trigger an alert for the entire alert result set. 

2. Adjust the search to collect all of the "records" for EACH workflowname into a single "event", and then run your alert the same way you are doing it. You can do this by running a search like the following (ignore the first part, which is just creating some data for me to work with)

 

| makeresults count=6 | streamstats count | eval workflowname=case(count<=3,"workflow1",count=4,"workflow3",count>=5,"workflow2"), runid=case(count<=3,123,count=4,555,count>=5,678), count_field=case(count=1,3,count=2,8,count=3,2,count=4,10,count=5,12,count=6,4), status=case(count=1,"completed",count=2,"paused",count=3,"completed",count=4,"running",count=5,"running",count=6,"completed")
```IGNORE EVERYTHING ABOVE THIS LINE. THIS IS JUST CREATING SOME SAMPLE DATA TO WORK WITH```

| table workflowname count_field runid status
| eval concat_field="workflow=".workflowname." ::: runid=".runid." ::: count=".count_field." ::: status=".status
| stats values(concat_field) as concat_field by workflowname

 

0 Karma

Nithianandan
Observer

@jdunlea  Thank you for the response. Beauty here is we have more than 250 + workflows. It's difficult to adapt search query for each of workflowname.

 

I will put in other words. This alert needs to be triggered irrespective of the count but once per day but condition is separate email for different workflowname. 

 

0 Karma

jdunlea
Contributor

Ah I see. Then your best bet will be to do something like the search I had posted. This will essentially group all of the events into a single event, for each value of workflowname, and then you can send your email based off of those values for workflowname and suppress based on the same field. 

 

Let me know if this makes sense and if the search which I provided gives you the outcome you are looking for. 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...