How do I setup an alert based on the value returned from a search? I havea simple search: index=core ....| stats max(kpi) as kpi This gives a value of 30,000 Now I want to set up an alert that when this goes below 10,000 to trigger an alert. I will use an email initially for testing. How do I do this? Once I have the search ready I click Save as -> Alert and these options are presented my specific query is around the Trigger Alert when. The options are: 1. Number of Results 2. Number of Hosts 3. Number of Sources 4. Custom None of these seem to be what I want. I was expecting a value of search as an option in that when then value is <10,000 Alert me. What am I missing here? The custom option does not appear to offer anything. I am reading here ... View more

When I run a scheduled report with PDF atachment, I can use this token in the email body: $job.latestTime$ Which will result in the following in the email body when the email is sent: 2018-02-08T10:09:02.000+13:00 How can I format this time/date to be as follows YYYY-MM e.g. 2018-02? Or one step further would be to do current month minus 1 month e.g. 2018-01? I was thinking something like this Assuming: $job.latestTime$ = 2018-02-08T10:09:02.000+13:00 Then I thought I could do something like this in the email body: eval x=strptime($job.latestTime$,"%Y-%m-%d") x = $x$ But this does not work. Can I do what I am trying to do here docs here which gives a list of the available tokens : http://docs.splunk.com/Documentation/Splunk/6.5.0/Report/Schedulereports ... View more

How do I format a number with commas in a column/field that has numbers and strings(using appendpipe) I have the following search: | makeresults | eval data = " 1 2017-12 A 155749 131033 84.1; 2 2017-12 B 24869 23627 95; 3 2017-12 C 117618 117185 99.6; " | makemv delim=";" data | mvexpand data | rex field=data "(?<serial>\d)\s+(?<date>\d+-\d+)\s+(?<type>\w)\s+(?<attempts>\d+)\s+(?<successfullAttempts>\d+)\s+(?<sr>\d+)" | fields + date serial type attempts successfullAttempts sr | rename date as _time | search serial=* | appendpipe [stats avg(sr) as sr | eval sr=round(sr,1) | eval successfullAttempts="average sr"] Which gives me the below: _time serial type attempts successfullAttempts sr 1 2017-12 1 A 155749 131033 84 2 2017-12 2 B 24869 23627 95 3 2017-12 3 C 117618 117185 99 4 average sr 92.7 What I want to do is format the columns attempts and successfullAttempts , to have commas in their numbers. But because average sr falls in the successfullAttempts column I am having trouble. By placing the formatting before the append pipe, my "average sr" is removed or does not appear in the successfullAttempts column. **Can I make it so it stays there and the formatting? ... | fieldformat attempts=tostring(attempts,"commas") | fieldformat successfullAttempts=tostring(successfullAttempts,"commas") | appendpipe [stats avg(sr) as sr | eval sr=round(sr,1) | eval successfullAttempts="average sr"] This gives me the following: (note the text "average sr" has been removed from the successfulAttempts column) _time serial type attempts successfullAttempts sr 1 2017-12 1 A 155749 131033 84 2 2017-12 2 B 24869 23627 95 3 2017-12 3 C 117618 117185 99 4 92.7 ... View more