Hello everyone, I have multiple fields and i want to extract an ID from it. (That's the only value that changes in it) My fields are : class, method, message, nb. Message field is like this : "] id not found for opp : [12345azeAZE" I wanted to extract the value after the "[" (in bold) and create a message with it. Can i have a result like this please : There are $nb$ errors from the method: $method$ with the class: $class$ on the opp: $message$. Thanks. ... View more

Hello everyone, There is my search : my_severity=error my_app="name" earliest=-48h latest=-24h   | stats count as nb_yesterday by my_method limit=0   | appendcols[search my_severity=error my_app="name" earliest=-24h latest=now | stats count as nb_today by my_method]   | eval increase=round(nb_today*100/nb_yesterday)   | eval status=if(increase>100 OR nb_today>10, "CRITICAL", "GOOD")   | table my_method, nb_yesterday, increase, status, nb_today   | sort nb_today desc my_severity, my_app and my_method are fields that i created myself with my search, i get multiple results (and multiple lines) and i want to send one mail with the list of CRITICAL status like : "Hello, we notice some errors : [name of the method(1)] [status] [increase] [nb_today] [name of the method(2)] [status] [increase] [nb_today] [name of the method(3)] [status] [increase] [nb_today] ... "   How can i send a mail with all the "CRITICAL" status for exemple ?   When i configure the mail alert with this body message :  "The method "$result.my_method$" was $result.status$ with $result.nb_today$ errors in the last 24hours. (That's a $result.increase$% increase) " I only send a mail with the informations of the first line.    Thanks.   ... View more