I have the following search:
index=* sourcetype=HAI | transaction name=grouped_events | search currentStatusText != "" | stats first(currentStatusText) as DisplayValue by name | search DisplayValue = "[NOT READY]" The attached screenshot show you my results.
NOT READY means that something is open in my house (the search is against my home security system)
I would like to run this search on a scheduled basis and send the list of 'names based on 'not ready' .
How can I send a list of items like this to an alert? Do I have to build a concatenated string? Or is there a way to send a list like this to an alert?
I have not yet been able to find an example to do this.
Thank you.
Rich
Use info from this link to setup your search as alert
http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Definescheduledalerts
Use this link to setup the Email notification and make sure to configure 'Include' with option "Inline results formatted as a table, raw events, or CSV file"
http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Emailnotification
Use info from this link to setup your search as alert
http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Definescheduledalerts
Use this link to setup the Email notification and make sure to configure 'Include' with option "Inline results formatted as a table, raw events, or CSV file"
http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Emailnotification
Inline table doesnt work well with cellphone text messages. I need to just provide the names of all items to the cellphone in a text message.
If it was just an email - inline table would work fine.
Any idea of how to do this for a cellphone. As i was thinking - maybe building a concatenated string?
You can merge all name into one string like this
index=* sourcetype=HAI | transaction name=grouped_events | search currentStatusText != "" | stats first(currentStatusText) as DisplayValue by name | search DisplayValue = "[NOT READY]" | stats values(name) as name delim="," | nomv name
B-I-N-G-O!! Thats exactly what i'm looking for!!
TY
Glad you found your answer 🙂 Don't forget to upvote @somesoni's comment for helping you out.
Cheers!
Patrick
I would like to send this as an alert to a cellphone via text message. Which is why the inline table doesn't work well.