Hi
At this time i have 2 alerts that are triggered every morning and i receive 2 separate e-mails. Would it be possible to have just one e-mail that contains the results from the 2 alerts ?
Alert1:
sourcetype = test host="host1" "condition"
| eval name=substr(source,16,8)
| eval portal=if(name== "name01" , "title1" , if(name== "name02" , "title2" , if(name== "name03" , "title3" , NULL)))
| stats first(portal) as Portal count(name) as Name by name
Alert2:
sourcetype = test host="host2" "condition"
| eval name=substr(source,16,8)
| eval portal=if(name== "name01" , "title4" , if(name== "name02" , "title5" , if(name== "name03" , "title6" , NULL)))
| stats first(portal) as Portal count(name) as Name by name
The returned name value is the same on all hosts but the intended title is different.
If anyone can point me in the right direction, that would be fantastic.
Thank you advance.
Hi
try this search code in to group these two alerts in one alert
sourcetype = test host="host1" OR host="host2" "condition"
| eval name=substr(source,16,8)
| eval portal=case((host=="host1" AND name== "name01") , "title1" , (host=="host1" AND name== "name02") , "title2" , (host=="host1" AND name== "name03") , "title3" , (host=="host2" AND name== "name01"), "title4",(host=="host2" AND name== "name02"), "title5",(host=="host2" AND name== "name03"), "title6")
| stats first(portal) as Portal count(name) as Name by name
Hi
try this search code in to group these two alerts in one alert
sourcetype = test host="host1" OR host="host2" "condition"
| eval name=substr(source,16,8)
| eval portal=case((host=="host1" AND name== "name01") , "title1" , (host=="host1" AND name== "name02") , "title2" , (host=="host1" AND name== "name03") , "title3" , (host=="host2" AND name== "name01"), "title4",(host=="host2" AND name== "name02"), "title5",(host=="host2" AND name== "name03"), "title6")
| stats first(portal) as Portal count(name) as Name by name
good thanks
Don't forget to vote