Alerting

How to include a text message in an alert?

raghavprakasam
New Member

Hi ,

I have used '$result.message$' to print a specific field in the log over the email.But this reference prints the message 2 times.I have totally 11 occurrences for the search string at the same time.I have triggered the alert after 10th occurrence.I just want to print this message only once,Is there any way?

Tags (1)
0 Karma

DavidHourani
Super Champion

Hi @raghavprakasam,

I see multiple solutions for your problems :

1- You can use the dedup command to drop the number of results to one.
2- You can use the stats count by youreventcommand and change the condition to trigger on the count >10 instead of counting the events with the alert.
3- You can leverage the alert throttle to reduce the total number of message you receive.

Let me know the query you are using and I can help you fix it to reduce the number of events if you're not able to with the above.

Cheers,
David

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Converted from an answer to a question.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...