Hi,
I'm trying to run the following query:
index=alerts Status="Open" AlertId="30822ac3b4a6138de30c5726e2e05931"|table _time, AlertId, host, user, AlertMsg, "Close", |head 1
|outputcsv updatedalert | movealert
movealert at the end of the query is a batch file hosted on my server.
If I run the first part of the command, it creates the updatedalert.csv file as expected.
If I run a search only with "| movealert" alone, the script executes and moves the files to my lookup directory.
But when I try to run both command combined, none of them executes as if one was blocking the other.
Any idea if (and how) I can this to work?
Hi..
try below query..
| movealert [search index=alerts Status="Open" AlertId="30822ac3b4a6138de30c5726e2e05931"|table _time, AlertId, host, user, AlertMsg, "Close", |head 1
|outputcsv updatedalert | return NULL]
Hi..
try below query..
| movealert [search index=alerts Status="Open" AlertId="30822ac3b4a6138de30c5726e2e05931"|table _time, AlertId, host, user, AlertMsg, "Close", |head 1
|outputcsv updatedalert | return NULL]
Works perfectly! Thanks a lot anjambha!