Splunk Search

How do I make a custom alert message with variables?

rbrisseyii
Explorer

Hello,

I have a search with several OR statements in it. Example, Microservice=this OR Microservice=that. When the search runs and emails me an alert, I currently have it set to "$result.Microservice$ with $job.resultCount$ alerts".

In the text of the email, it only returned the name of the first Microservice, but gave me a total count of both This and That's events.

I would like it to give me:
"This" had x alerts
"That" had y alerts

Any suggestions to how I can have the email alert give me totals for each Microservice? I actually have a few more Microservices in my real search, I only listed 2 above.

Thanks.

Tags (1)
0 Karma
1 Solution

rbrisseyii
Explorer

my search | eventstats count as _toemail by Microservice SiteType | eval _toemail = Microservice . " " . SiteType . " had " . _toemail . " alerts.\n" | eventstats values(_toemail) as _toemail | eval _toemail = mvjoin(_toemail, " ")

which provides the following out put in email:
microservice1 Prod had 336 alerts.
microservice2 Prod had 23 alerts.
microservice3 Prod had 5 alerts.

View solution in original post

0 Karma

burwell
SplunkTrust
SplunkTrust

Hi @rbrisseyii what I tend to do in this situation is

my search
| stats count by Microservice SiteType
| eval Microservice_SiteType_count = MicroService + " " + SiteType + " = " + count + "alerts"
| stats values(Microservice_Sitetype_count) as Microservice_counts

And then I use $result.Microservice_counts$ in your alert

You can format the eval however you like.

The idea is you are creating field Microservice_SiteType_count for each Microservice SiteType pair
And then finally you are looking at the values of all those pairs and you can grab it in your alert by using $result.Microservice_counts$

0 Karma

rbrisseyii
Explorer

my search | eventstats count as _toemail by Microservice SiteType | eval _toemail = Microservice . " " . SiteType . " had " . _toemail . " alerts.\n" | eventstats values(_toemail) as _toemail | eval _toemail = mvjoin(_toemail, " ")

which provides the following out put in email:
microservice1 Prod had 336 alerts.
microservice2 Prod had 23 alerts.
microservice3 Prod had 5 alerts.

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

I'm glad you figured out an answer to your question @rbrisseyii. Would you mind accepting it so that others will know it's the correct solution?

Thanks!

0 Karma

burwell
SplunkTrust
SplunkTrust

Hi @rbrisseyii can you share your exact search?

0 Karma

rbrisseyii
Explorer

I will just provide the solution I was given through the Splunk Community Slack channel:

| eventstats count as _toemail by Microservice SiteType | eval _toemail = Microservice . " " . SiteType . " had " . _toemail . " alerts.\n" | eventstats values(_toemail) as _toemail | eval _toemail = mvjoin(_toemail, " ")

which provides the following out put in email:
microservice1 Prod had 336 alerts.
microservice2 Prod had 23 alerts.
microservice3 Prod had 5 alerts.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...