Hi All,
I have data like below with three fields : srcip,dstip and title . When I execute below query
.........| stats count by srcip,dstip,title
Result :
srcip dstip title
srcip1 dstip1 title
srcip1 dstip2 title
srcip2 dstip2 title1
srcip2 dstip3 title1
srcip1 dstip2 title2
So we required to alert separate on basis title values. For all events of one title, there should be one alert. So above example there should be trigger 3 separate alerts .
Thank you ! in Advance
You can fire alert either once per whole result set or separately per each result row. So if you want three alerts from six rows, you have to adjust your search to "squeeze" multiple results into one row.
Have a go with:
| stats count values(srcip) as srcip values(dstip) as dstip by title
This should produce three rows and therefore 3 alerts, where the srcip and dstip are multi-value fields.
Thank you for your response.
I have already tried this. In this search I am getting multiple srcip and multiple dstip In one row. I required one row for one srcip to one dstip but alert should be trigger saperatly title wise .
I can't think of a practical way to make an alert that will alert once per title, but also have many separate rows per title. You may be trying to do too much with one module.
You could set up the alert to use multi-value fields as per my previous suggestion, but then include a link in the alert to a separate search where each title is separate.