Hi colleagues, i have faced the same issue and just curious where actually the limitation defined (for alert action to lookup )   KR, Lis ... View more

Hi @yuanliu ,  I dont need send one row of statistical data to particular email, but group of many records/rows to particular email as discribed below. ... View more

My apologies for not clear explination.  Yes, dest and source values will be fetched and stored to lookup in prior query from the same index and sourcetype. My first query will fetches the list of dest and source with particular thresholds, look below: index=test sourcetype=main (filters) | stats count by dest source | where count > 100 source dest Count_of_records a x 345 b y 247 c z 144 but I need to send not statistical data, but certain records with more details. So, i will run second query with filter SOURCE and DEST from my lookup, for the same time period without grouping to get all records with all available fields. This is not fit my requirements, because I will send all (345+247+144): index=test sourcetype=main  [(| inputlookup Lookup_x.csv)] | table *   While I need send 345 to first email, and 247 to second and so on...             ... View more

Hi @yuanliu  thank you for your reply. I have seen this general approach how to send particular one row to certain email, but in my case it is something more complex). I need to use Source and Dest from lookup as filer in every search and send a table with results(might be many rows) to certain contact.    Lookup_x: source dest contact a x 1@email.com b y 2@email.com c z 3@email.com     index=test sourcetype=main | inputlookup Lookup_x.csv  | where source = a AND dest = x | table *   source dest Another field Another field Another field a x       a x       a x         Send the table above to 1@email.com   index=test sourcetype=main | inputlookup Lookup_x.csv  | where source = b AND dest = y | table *   source dest Another field Another field Another field b y       b y       b y         Send the table above to 2@email.com   ... View more

    <condition match="'value' LIKE &quot;object%&quot;"> ... View more

Hi @richgalloway    Thank you for your response. But in my case there are no groups, because i used also another field (id) in by section, which is unique. So I expected to see all events with their original timestamps. ... View more

Hi @tscroggins , It is so perfect and simple(since it was invented by somebody😊). Thank you very much! I have adjusted it a bit to fit to my case, because have faced "waiting for input"  in my table.  <set token="field_tok"></set> <set token="value_tok"></set> <input type="dropdown" token="filter_tok" > <label>Filter</label> <choice value="eq">Equals</choice> <choice value="ne">Does Not Equal</choice> <choice value="co">Contains</choice> <choice value="nc">Does Not Contain</choice> <choice value="bw">Begins With</choice> <choice value="ew">Ends With</choice> <choice value="li">Length is</choice> <choice value="lg">Length is greater than</choice> <choice value="ll">Length is less than</choice> <choice value="nb">Does Not Begin With</choice> <choice value="nw">Does Not End With</choice> <choice value="ps">Pls select</choice> <default>Pls select</default> </input>   | where coalesce( case( "$filter_tok$"=="eq", '$field_tok$'==_value_tok, "$filter_tok$"=="ne", '$field_tok$'!=_value_tok, "$filter_tok$"=="co", like('$field_tok$', "%"._value_tok."%"), "$filter_tok$"=="nc", NOT like('$field_tok$', "%"._value_tok."%"), "$filter_tok$"=="bw", like('$field_tok$', _value_tok."%"), "$filter_tok$"=="ew", like('$field_tok$', "%"._value_tok), "$filter_tok$"=="li", len('$field_tok$')==coalesce(tonumber(trim(_value_tok)), -1), "$filter_tok$"=="lg", len('$field_tok$')&gt;coalesce(tonumber(trim(_value_tok)), 9223372036854775807), "$filter_tok$"=="ll", len('$field_tok$')&lt;coalesce(tonumber(trim(_value_tok)), -1), "$filter_tok$"=="nb", NOT like('$field_tok$', _value_tok."%"), "$filter_tok$"=="nw", NOT like('$field_tok$', "%"._value_tok), "$filter_tok$"=="ps", (1==1) ), false())   ... View more

Maybe it is correct from theoretical side, but it was checked in a practical way: In comparison query with prestats for the same data and time frame takes 0.874 seconds | tstats prestats=t count(your field) where index=index by field | head 50 | stats count(your field) by field This search has completed and has returned 5 results by scanning 6,460 events in 0.874 seconds   While without prestats - > 6.305 seconds | tstats count(your field) where index=index by field | head 50 This search has completed and has returned 5 results by scanning 76,972 events in 6.305 seconds   ... View more

This is possible with argument prestats=t and then for example command stats: | tstats prestats=t count(your field) where index=index by field | head 50 | stats count(your field) by field     ... View more