How do you include a varying number of a Splunk Search's field values in an email alert?

[samsam48]

I have a Splunk Search that returns events that have an alert-type field value of "Severe", "Moderate", and "light". Each event also has a corresponding description field description outlining what happened. Within the email alert that I set up, how can I group these events by alert type and then apply logic to display how a certain number of their corresponding descriptions? For example, if the "Severe" group has less than 5 results, display all 5 descriptions in the email. However, if the "Moderate" group has over 300 results, don't bother showing any descriptions.

Also, is there an easy way to get counts of these events within the email body logic- like printing to the email body that there were X number of results for each type? Or are these in the search itself?

[renjith_nair]

@samsam48,

If you have definite number for each alert-type for e.g. 5 then you could filter it in the main search itself.

"your search"|fields alert-type,description|eventstats count by  alert-type
|eval description=if(count>5,"",description)|stats values(description) as description,values(count) as count by alert-type

Run anywhere example

index=_*|fields source,sourcetype|eventstats count by sourcetype|table source,sourcetype,count
|eval source=if(count>100," ",source)|stats values(source) as source,values(count) as count by sourcetype

[renjith_nair]

@samsam48, did it help you ? If yes, then I would convert it as answer and then you can accept it to close this thread.