How to trigger an alert if any value in a table crosses a threshold and include details about the corresponding field in the email?

[pashernx]

I want to create an alert based on a table like below:

Field| Value
A| 10
B| 25
C| 40
D| 30
E| 45
F| 15

The alert should be triggered when any of the field values cross a threshold (say 50). I would like to have the details about the field that caused the alert on the email. Is there a possibility to do this in a single alert in Splunk or should I created multiple alerts for each row?

Thanks,

[woodcock · Accepted solution]

You can use this search

... | stats max(Value) AS MaxValue BY Field | where MaxValue > 50

Then have the alert email and "include result inline" and trigger when numresults>0

[pashernx]

Thanks it worked.