Splunk Search

How do I show the source file and host for a search result in email alerts?

cj039165
New Member

I have an alert set up that will send an email to a group of individuals when we get responses from a payer with AAA*Y**41 in it. What I would like to include is the source file this string was found in and, if possible, the Host it was found on. It's possible this could show up in 226 different files. I can't email the raw data, it contains personal health information.

Search :

index=hdx_payer source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/*_Receive.log" | regex "AAA\*Y\*\*41\*"

Thanks

0 Karma

JDukeSplunk
Builder

It should be something like this:

    index=hdx_payer source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/*_Receive.log"
 | regex "AAA*Y**41*"
 | stats count(source) as COUNT by source host

This should give you a table that shows the number of hits per source file, per host.

0 Karma

pradeepkumarg
Influencer

Is this what you are looking for?

index=hdx_payer source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/*_Receive.log" | regex "AAA\*Y\*\*41\*"  | table host, source 
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...