How to get the Patterns Tab as an emailed scheduled report?

[daniel333]

All,

LOVE the patterns tab. Is there a way for me to get that as an emailed scheduled search for my users?

[ChrisG · Accepted solution]

Yes, you can. Just click a pattern, then click Create alert in the pattern information area on the right.

[s2_splunk]

Yup, and you can add | cluster t=0.3 labelonly=true labelfield=_patterns match=termset | findkeywords labelfield=_patterns dedup=true to any base search to identify clusters of events if you want to build your own view.