Splunk Alert how to trigger alert for x amount of record

[egysing]

I create an alert to send the result of search to email.
However I only want 40 of records to be send per email.

For example, the search may have 200 results and I want the alert send all but only 40 records per email.
so I will got 5 separate emails for the 200 result.

Please help. Thank you

[aberkow]

Hi - so I have a few thoughts here, but I like the following one if you're willing to sacrifice a bit of performance. Basically, you will split the results into 5 bins, and then send the alert "for each result" as opposed to once as the trigger option:

| makeresults count=200
| eval field="hello"
| streamstats count
| bin count bins=5
| stats list(field) by count

This example creates 200 results, gives them all a field value, counts each row, bins the count into 5 bins, takes the list (you probably want values if it's non-unique list of records) to compress the results into 5 distinct sets of results in a multivalue field. Then, you can select the trigger to be for each result instead of just once, and this should solve a simple use case for you. You might want to do some work with mvzip to tie multiple fields together if you're trying to just create one mvfield to send the info through.

Hope this helps!