Alert on table with custom email subject field value

[rmiller3]

I got an alert working "for each result" by using a query that creates the following table:

errorType             count

Client                  10
Credentials      50
Unknown             5

How do I set a different threshold for each result?

I tried using a custom trigger as follows and was hoping to only get an email for "client" and "credentials", but I still get all 3.

search (errorType = "Client" AND count > 8 ) OR (errorType = "Credentials" AND count > 8 ) OR (errorType = "Other" AND count >8 )

[rmiller3]

That works.  I was really trying to have a custom alert message with just the thresholds (since my query categorizes different error types and is fairly long, I was hoping not to put it in the alert email). 

However, I think putting the whole query is fine at the end of the day, thanks!

[marnall · Accepted solution]

That should work already. Could you try putting that search filter at the end of your alert search?

<yoursearch>
| search (errorType = "Client" AND count > 8 ) OR (errorType = "Credentials" AND count > 8 ) OR (errorType = "Other" AND count > 8 )