I need to customize the alert message (send via email) with information that is not intrinsic to the alert itself. For example, if the number of users logging in over a 5 minute period exceeds a threshold, then send the alert email with the number of IP addresses that have logged in in that time period. Trying to use Custom Alert Actions, but we feel that there may be an easier way to execute. Is there a way to have an alert trigger a report, then email that contents to a select group? We have an alert X. This alert is setup so it triggers at custom machine learning parameters. It will only trigger when the actual number of events is much higher than the mathematical prediction.  When X is triggered, we need to do 2 things. Firstly, run a report compiling all the information needed to triage. A lot of this is in a Dashboard, but can be run through any number of report and/or splunk query ways. Secondly, we need the information in that report or queries to be put into an email, either by the file itself or using Splunk tokens to convey the report results. My approach in my head is alert > run report > email data from that report.  Thanks in advance! ... View more

Hi, I am trying to find the outliers in a specific set of data (a count of login failures within 5 minutes). I have created and assigned the variable residual, which is the prediction (using algorithm LLP) minus the count. I have then cut out all the positive values, because I only want to catch large differences.  What I am trying to do is figure out how to correspond what I have been doing with the Detect Numeric Outliers Assistant into a model I'm creating. Basically, how do I move an adjust the threshold so that it only catches a few outliers? I have already tried to assign value to threshold and well as lower_threshold and upper_threshold, but it only shades the areas around the data set. Currently I have recreated what I was in the Detect Numeric Outliers Assistant and copy/pasted the SPL from that to see if I can assign it to the algorithm. Below is my example:       1| inputlookup loginfailures_count_5m.csv 2| eval _time=strptime(_time,"%Y-%m-%dT%H:%M:%S.%Q") #lines 1 and 2 are the csv file 3| predict count as prediction algorithm=LLP future_timespan=150 holdback=0 4| where prediction!="" AND count!="" 5| eval residual = prediction - count #lines 3 - 5 are setting what perdiction and residual do 6| eval residual = if(residual < 0, residual, 0) #this line gets rid of all positive values, we only want negative values 7| eventstats avg("residual") as avg stdev("residual") as stdev 8| eval lowerBound=(avg-stdev*exact(6)), upperBound=(avg+stdev*exact(6)) 9| eval isOutlier(residual)=if('residual' < lowerBound OR 'residual' > upperBound, 1, 0) #lines 7 - 9 are the SPL from the Detect Numeric Outliers Assistant, may not be the "answer" 10| fit DensityFunction residual show_options="feature_variables" into my_model #have tried different settings here, unsucessful, this is where we feel the problem lies 11| apply my_model       My DensityFunction Outliers graph looks like this: but I need it to look  like this (populated with the Detect Numeric Outliers Assistant): Any pointers/settings I haven't tried yet? Does anyone know a 1 to 1 correlation between the settings on the Assistant that translate into the DensityFunction (i.e.- what setting does a "sliding window")? Have looked through the docs here to no avail.   ... View more