Splunk Search

How can I combine stats count by host into a single string to be used in an alert actions token?

burwell
SplunkTrust
SplunkTrust

I have a search that looks like

index=foo value=bar | stats count by host

Imagine you might get results like

host     count
host1   123
host2    456
host3    789

We want to alert when the count is greater than some threshold and I can do that.

What I also want to do is to create a new field that we can use an alert actions token.

So imagine in the above example we had a new field called badhosts whose value was the concatenation of the hosts with their count. For example "host1:123 host2:456 host3:789"

Each host is represented by its count.

The reason to do this is so I can then use $result.badhosts$ as a token and we can see all the hosts and their values.

How to do this? Thanks.

0 Karma
1 Solution

efavreau
Motivator

@burwell Sounds like you're looking for sistats

index=foo value=bar | sistats values(host) as hosts
###

If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

efavreau
Motivator

@burwell Sounds like you're looking for sistats

index=foo value=bar | sistats values(host) as hosts
###

If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

burwell
SplunkTrust
SplunkTrust

Perfect! Thanks!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!