Group searches or alerts

[andrei1bc]

Hi

At this time i have 2 alerts that are triggered every morning and i receive 2 separate e-mails. Would it be possible to have just one e-mail that contains the results from the 2 alerts ?

Alert1:

sourcetype = test host="host1" "condition"
| eval name=substr(source,16,8)
| eval portal=if(name== "name01" , "title1" , if(name== "name02" , "title2" , if(name== "name03" , "title3" , NULL)))
| stats first(portal) as Portal count(name) as Name by name

Alert2:

sourcetype = test host="host2" "condition"
| eval name=substr(source,16,8)
| eval portal=if(name== "name01" , "title4" , if(name== "name02" , "title5" , if(name== "name03" , "title6" , NULL)))
| stats first(portal) as Portal count(name) as Name by name

The returned name value is the same on all hosts but the intended title is different.

If anyone can point me in the right direction, that would be fantastic.
Thank you advance.

[chimell · Accepted solution]

Hi
try this search code in to group these two alerts in one alert

sourcetype = test host="host1" OR host="host2" "condition"
     | eval name=substr(source,16,8)
     | eval portal=case((host=="host1" AND name== "name01")  , "title1" , (host=="host1" AND name== "name02") , "title2" , (host=="host1" AND name== "name03") , "title3" , (host=="host2" AND name== "name01"), "title4",(host=="host2" AND name== "name02"), "title5",(host=="host2" AND name== "name03"), "title6")
     | stats first(portal) as Portal count(name) as Name by name

[chimell]

good thanks
Don't forget to vote