I have a search that looks like
index=foo value=bar | stats count by host
Imagine you might get results like
host count
host1 123
host2 456
host3 789
We want to alert when the count is greater than some threshold and I can do that.
What I also want to do is to create a new field that we can use an alert actions token.
So imagine in the above example we had a new field called badhosts whose value was the concatenation of the hosts with their count. For example "host1:123 host2:456 host3:789"
Each host is represented by its count.
The reason to do this is so I can then use $result.badhosts$
as a token and we can see all the hosts and their values.
How to do this? Thanks.
@burwell Sounds like you're looking for sistats
index=foo value=bar | sistats values(host) as hosts
@burwell Sounds like you're looking for sistats
index=foo value=bar | sistats values(host) as hosts
Perfect! Thanks!