Splunk Search

How to trigger an alert if any value in a table crosses a threshold and include details about the corresponding field in the email?

Explorer

I want to create an alert based on a table like below:

Field| Value
A| 10
B| 25
C| 40
D| 30
E| 45
F| 15

The alert should be triggered when any of the field values cross a threshold (say 50). I would like to have the details about the field that caused the alert on the email. Is there a possibility to do this in a single alert in Splunk or should I created multiple alerts for each row?

Thanks,

0 Karma
1 Solution

Esteemed Legend

You can use this search

... | stats max(Value) AS MaxValue BY Field | where MaxValue > 50

Then have the alert email and "include result inline" and trigger when numresults>0

View solution in original post

Esteemed Legend

You can use this search

... | stats max(Value) AS MaxValue BY Field | where MaxValue > 50

Then have the alert email and "include result inline" and trigger when numresults>0

View solution in original post

Explorer

Thanks it worked.

0 Karma