- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Only One Results are part of the email notifications- How do I get multiple results?
Hello Friends,
Basesearch | Table workflowname runid count status.
When it's serached,results will be as mentioned below
workflowname runid count status
Workflowname1 123 5 Completed
Workflowname2 456 7 Paused
Workflowname1 789 8 Completed
Workflowname3 1011 4 Running
Workflowname1 1013 4 Running
Workflowname2 432 8 Completed
I have configured an alert,to trigger when the result are greater than 0. Which means all the above mentioned results will be part of the email alert notification. When I use the suppress option by mentioning the fieldname as workflowname only one result been recieved as a part of email alert notifications.
Example how now the email is received
Email received for the Workflowname1
workflowname runid count status
Workflowname1 123 5 Completed
Email received for the Workflowname2
workflowname runid count status
Workflowname2 456 7 Paused
Can someone help out here with different email alert all the results for the unique workflowname should be triggered.
Excepted one -
One mail for the workflowname1
workflowname runid count status
Workflowname1 123 5 Completed
Workflowname1 789 8 Completed
Workflowname1 1013 4 Running
Other email for the workflowname2
workflowname runid count status
Workflowname2 456 7 Paused
Workflowname2 432 8 Completed
Separate email for the workflowname3
workflowname runid count status
Workflowname3 1011 4 Running
Looking forward to hear inorder to achieve the above result
Thanks for the support.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A few things to note here:
- When you configure the alert to trigger "when the result are greater than 0" this means that it will trigger as long as there is at least one result returned from the search. This is NOT looking at your field called "count". In your example, the alert fires and has 6 results, and hence the condition for "when the results are greater than 0" will be triggered.
- Unfortunately, if you are suppressing based on the workflowname, then you cannot have 3 separate emails triggered the way you want, using only 1 alert. Because as soon as Splunk sees a THE FIRST result for WorkFlow1, then it will only trigger an email for that result, before checking for other values for workflowname.
You have two options in this situation:
1. Create 3 different alerts. Each one will look for a specific workflowname and trigger an alert for the entire alert result set.
2. Adjust the search to collect all of the "records" for EACH workflowname into a single "event", and then run your alert the same way you are doing it. You can do this by running a search like the following (ignore the first part, which is just creating some data for me to work with)
| makeresults count=6 | streamstats count | eval workflowname=case(count<=3,"workflow1",count=4,"workflow3",count>=5,"workflow2"), runid=case(count<=3,123,count=4,555,count>=5,678), count_field=case(count=1,3,count=2,8,count=3,2,count=4,10,count=5,12,count=6,4), status=case(count=1,"completed",count=2,"paused",count=3,"completed",count=4,"running",count=5,"running",count=6,"completed")
```IGNORE EVERYTHING ABOVE THIS LINE. THIS IS JUST CREATING SOME SAMPLE DATA TO WORK WITH```
| table workflowname count_field runid status
| eval concat_field="workflow=".workflowname." ::: runid=".runid." ::: count=".count_field." ::: status=".status
| stats values(concat_field) as concat_field by workflowname
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@jdunlea Thank you for the response. Beauty here is we have more than 250 + workflows. It's difficult to adapt search query for each of workflowname.
I will put in other words. This alert needs to be triggered irrespective of the count but once per day but condition is separate email for different workflowname.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ah I see. Then your best bet will be to do something like the search I had posted. This will essentially group all of the events into a single event, for each value of workflowname, and then you can send your email based off of those values for workflowname and suppress based on the same field.
Let me know if this makes sense and if the search which I provided gives you the outcome you are looking for.
