Posting this reply again -- somehow I replied to my own post. Yes, I'm anticipating quite large emails full of events. I'm thinking that another evolution of this might be to filter out uninteresting results by having a lookup table of events to be ignored... or something similar. I'm essentially just wanting an emailed digest of events from host syslogs, sorted by host, in ascending order by time. I've played around a bit more and got to this: index=myindex | sort 0 host, _time | stats count as events, values(_raw) by host This gives a table of results with 3 columns -- host, events and a list of raw events for the host. This is almost what I want, but it would be nice not to have the first two columns taking up space on the left, but instead to have that information as a heading for the list of events in a single column. Thanks.
... View more
