- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have set up a couple of alerts and have chosen an inline table in the subsequent email. The contents of that table, however, seem almost totally random. Does anyone know where those fields come from and how they can be changed? I can see a display.events.fields setting in savedsearches, but I don't know if this has any bearing on it nor where the current fields in there came from. If I change them, it doesn't affect the content of the alert email.
The search is simply looking for values over a particular numeric threshold:
sourcetype=dbcsv | eval percent_used=((LogFileSizeMB/DataFileSizeMB)*100) | eval percent_used=round(percent_used,1) | search percent_used>90
Ideally I'd like the email to contain a table that I can produce on a dashboard: _time, DataFileSizeMB, LogFileSizeMB, percent_used
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use this as your alert search
sourcetype=dbcsv | table _time, DataFileSizeMB, LogFileSizeMB, percent_used| eval percent_used=((LogFileSizeMB/DataFileSizeMB)*100) | eval percent_used=round(percent_used,1) | search percent_used>90
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use this as your alert search
sourcetype=dbcsv | table _time, DataFileSizeMB, LogFileSizeMB, percent_used| eval percent_used=((LogFileSizeMB/DataFileSizeMB)*100) | eval percent_used=round(percent_used,1) | search percent_used>90
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK great thanks that works. I had a table command in it previously and the whole alert wouldn't work but that must have been to do with some fields I had in the root search. This solution works and I can add what I need, thanks.