Emailing selected Fields with Alert

[aniketb]

Hi,

I'm trying to create an alert which emails me just the "host", "sourcetype" and "source" in the email.
I know we have an option of "Include results in email" but this alert flags off after 1000 events and I don't need any info from the log, I just need to look at those 3 fields.

Any possible way to do this?

[aniketb]

How do you shortlist them in search? e.g. i tried this method on finding the string "invalid password". I set an alert on
"invalid password" | fields + host,source,sourcetype
It gave me an email just with the alert name and the link pointed back again to the whole list of logs.

[Kate_Lawrence-G]

I was thinking something more along the lines of this:

sourcetype= "A string!" | eval error="A string!" | stats c(error) as e, values(host),values(source) by sourcetype | where e > 0

You can either keep the where in the search and alert when events are found OR you can take it out and put it in as the conditional alerting custom condition.

In this context it will send you the host/source and sourcetype information as the results of the search.

[Kate_Lawrence-G]

I think the best way to accomplish that is to make your alert condition not based on your results but instead a custom condition that way you can modify your results to be the host/sourcetype/source and provide those in your email instead.