All Apps and Add-ons
Highlighted

HipChat Room Notification Alert: How to get all the results of an alert email to also appear in HipChat and other custom alerts?

SplunkTrust
SplunkTrust

We have an alert that returns a set of errors by error type:

index=foo ... | stats count as count_errors by myfield | sort - count_errors | where count_errors > 0

This will produce

myfield        count
errortype1     45
errortype2     33
errortype3     10

We can get this table emailed to use using line and table.

For custom actions, e.g. HipChat, I can only see to get one value for the first one by referencing $result.myfield$

How can we get all the results that email would see to also appear in HipChat or other custom alerts?

0 Karma
Highlighted

Re: HipChat Room Notification Alert: How to get all the results of an alert email to also appear in HipChat and other custom alerts?

SplunkTrust
SplunkTrust

Try changing the alert mode of the search in Searches, Reports and Alerts, from Once per Search to Once per Result

View solution in original post

Highlighted

Re: HipChat Room Notification Alert: How to get all the results of an alert email to also appear in HipChat and other custom alerts?

SplunkTrust
SplunkTrust

Hmm. Wouldn't that cause two different alerts? I guess I can try and let you know.

0 Karma
Highlighted

Re: HipChat Room Notification Alert: How to get all the results of an alert email to also appear in HipChat and other custom alerts?

SplunkTrust
SplunkTrust

Yes I got two separate alerts back to back. At least I can see the info. Thanks.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.