Splunk Search

How to set up an alert to send an email with the output of another search?

kmasood
Explorer

I have an alert that sends emails when process count goes above a certain level. When these conditions are met, I would like Splunk to send an email with the output of another search command. For e.g.,

Alert search (already works):

index="os" host="host1*" sourcetype="top" COMMAND="httpd" | stats count

Follow-up search (run if previous alert's conditions are met):

index="apps" host="host1*" sourcetype="access*" | stats count(uri) by clientip,uri

How does one configure such (cascading?) alerts?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this.
Change the search of your current alert search to this and change the alert condition to "when number of greater than 0" . THis search will return events only if the where conditions are met.

 index="os" host="host1*" sourcetype="top" COMMAND="httpd" | stats count | where count > YOURLIMIT| map search="search      index="apps" host="host1*" sourcetype="access*" | stats count(uri) by clientip,uri"

kmasood
Explorer

That looks great, could you add a little bit of explanation of how this uses the map command? I'm not sure I understand "Looping operator, performs a search over each search result." from the docs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...