Splunk Search

Conditional email subject line

ygaluzo
New Member

Hello,
I have search
index=* ERROR | eval svc=mvindex(split(index,"-"),4) | stats count(svc) as cnt_svc by svc,source | where cnt_svc > 10

and my result can be for multiple services or for single service:
svc source cnt_svc


accounts /data/errors.log 120
accounts /data/system.log 23
users /data/system.log 34
orders /data/errors.log 83

or

svc source cnt_svc


accounts /data/errors.log 120
accounts /data/system.log 23

My email subject line has to be "Splunk errors for 3 services" in the 1st case or "Splunk errors for accounts" in the 2nd case.
Is it possible to do it?

Thank you.

Tags (2)
0 Karma

whrg
Motivator

Add this line to your search:

| eventstats count as totalcount

Now you should have an additional column "totalcount", which is 4 in this example:

svc       source            cnt_svc  totalcount
accounts  /data/errors.log  120      4
accounts  /data/system.log  23       4
users     /data/system.log  34       4
orders    /data/errors.log  83       4

Now change the email subject line of your alert to:

Splunk errors for $result.totalcount$ services
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...