My results are like :-
200 423405 757168 846810 OK 201 5704 15009 11408 HIGH COUNT 206 17 14 34 OK 301 20646 31255 41292 OK 302 11509 26836 23018 HIGH COUNT
I want to trigger the alert if the last column has even one occurrence value as "HIGH COUNT" ?Any suggestions
Extract it into a field and then add a filter for the value -
index=A sourcetype=B | rex "(\w+\s+){4}(?<COUNT_STATUS>.+)" | search COUNT_STATUS="HIGH COUNT"
If the number of events returned for the query is more than 0 would be the condition.
