We are using the below query for our alert, when we receive mail we want to see MESSAGE in Alert title. In subject we give Splunk Alert: $name$. in this place when the alert is triggered we want to...
See more...
We are using the below query for our alert, when we receive mail we want to see MESSAGE in Alert title. In subject we give Splunk Alert: $name$. in this place when the alert is triggered we want to view that Messages in the alert title. We tried giving Splunk Alert: $result.Message$, here only 1 message is showing up not all. how can we do it??? Query: index=app-index "ERROR"
|eval Message=case(
like(_raw, "%internal error system%"), "internal error system",
like(_raw, "%connection timeout error%"), "connection timeout error",
like(_raw, "%connection error%"), "connection error",
like(_raw, "%unsuccessfull application%"), "unsuccessfull application",
like(_raw, "%error details app%"), "error details app", 1=1, null())
|stats count by Message
|eval error=case(
Message="internal error system" AND count >0,1,
Message="connection timeout error" AND count >0,1,
Message="connection error" AND count >0,1,
Message="unsuccessfull application" AND count >0,1,
Message="error details app" AND count >0,1)
|search error=1