Hi
At this time i have 2 alerts that are triggered every morning and i receive 2 separate e-mails. Would it be possible to have just one e-mail that contains the results from the 2 alerts ?
Alert1:
sourcetype = test host="host1" "condition"
| eval name=substr(source,16,8)
| eval portal=if(name== "name01" , "title1" , if(name== "name02" , "title2" , if(name== "name03" , "title3" , NULL)))
| stats first(portal) as Portal count(name) as Name by name
Alert2:
sourcetype = test host="host2" "condition"
| eval name=substr(source,16,8)
| eval portal=if(name== "name01" , "title4" , if(name== "name02" , "title5" , if(name== "name03" , "title6" , NULL)))
| stats first(portal) as Portal count(name) as Name by name
The returned name value is the same on all hosts but the intended title is different.
If anyone can point me in the right direction, that would be fantastic.
Thank you advance.
↧