Splunk Alert how to trigger alert for x amount of record

New Member

I create an alert to send the result of search to email.
However I only want 40 of records to be send per email.

For example, the search may have 200 results and I want the alert send all but only 40 records per email.
so I will got 5 separate emails for the 200 result.

Please help. Thank you

Tags (1)
0 Karma


Hi - so I have a few thoughts here, but I like the following one if you're willing to sacrifice a bit of performance. Basically, you will split the results into 5 bins, and then send the alert "for each result" as opposed to once as the trigger option:

| makeresults count=200
| eval field="hello"
| streamstats count
| bin count bins=5
| stats list(field) by count

This example creates 200 results, gives them all a field value, counts each row, bins the count into 5 bins, takes the list (you probably want values if it's non-unique list of records) to compress the results into 5 distinct sets of results in a multivalue field. Then, you can select the trigger to be for each result instead of just once, and this should solve a simple use case for you. You might want to do some work with mvzip to tie multiple fields together if you're trying to just create one mvfield to send the info through.

Hope this helps!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...