severity as mandatory field, how to get this to work?

[tomblich-okta]

You indicate that severity is a mandatory field. I've tried a few different ways of trying to provide this but have not been unable. Can you provide examples of how this is to be included in the search results? I want to use this app, but can't figure out how to get past the mandatory severity field.

[dajomas]

[your base search]
| eval severity = case(checkValue == "0", "INFO", checkValue == "1", "WARN", checkValue == "2", "ERROR")
| table _time, severity, message

This is just an example. The example expects the base search to have a field message and a field checkValue. The eval sets the field severity. Now in the alert configuration enter fieldname severity in the Severity Field box. In the severity colors box, you could then use { "INFO": "black", "WARN": "orange", "ERROR": "red" }

Alternatively, using the above base search, you could ommit the eval line, then you would enter the fieldname checkValue in the Severity Field box and the severity color box would then contain { "0": "black", "1": "orange", "2": "red" }

I hope this helps. If not, can you please post your search (or send it to me via PM) and I will check what goes wrong for you.

[tomblich-okta]

a lot of our current searches just output a message based on if a search comes back with a certain amount of rows. I'm trying to understand how to set the severity based on that. Is there a way to have a default severity? I''m not following the the checkValue would be set? Why is severity mandatory?