Customized alert reports
[ Description ] [ Flow configuration ] [ Result ] [ Import this Flow ]
Description
A Flow that pulls an alert count from 2 different time periods, combines and transforms it into a specific format, and sends a report with the results via email to the required recipients.
This Flow checks the number of alerts triggered in the last hour and compares them with the alerts received over the same day and hour of the previous week. The info comparing both alert counts is sent via email every x minutes.
We've defined 2 different Flows for this use case. The final result is the same, but each works with different sequences and units. You can check the other version of this Flow by clicking the Version #2 tab at the top of this article.
Flow configuration
We've divided the configuration of this Flow into 2 different parts:
- Units - See the required units for this Flow and how to configure them.
- Links - Check how to link the units of this Flow to define the required sequence.
Units
The following table describes the units needed to create this Flow, and how to configure them.
Unit type | Description | Configuration | |||
---|---|---|---|---|---|
Generator | This unit will fire a signal event every x minutes (in this example, every minute) to activate the Flow. We will enrich these events using the following units and will use them to activate the required queries. |
| |||
Map | We will use a couple of Map units to enrich the events with time information. As said above, we will be comparing alerts triggered the last hour with alerts triggered over the same day and hour of the previous week. To do it, we will use these Map units to specify the start and end date of each period. | Drag 2 Map units to the canvas and follow the steps below to configure them:
| |||
Devo Full Query | We will use a Devo Full Query unit to specify the query that defines the alerts to be compared. We will be querying the | Drag a Devo Full Query unit to the canvas and configure it as follows:
| |||
Reducer | We will use a Reducer unit to format all the events received during each of the query periods set. Once this unit has stored all the alert info of a period, it will be sent to an additional Reducer unit, which will combine it with the info of the other period and generate a report. | Drag a Reducer unit to the canvas and configure it as follows:
| |||
Reducer | We will use this Reducer to combine the information formatted by the previously added Reducer unit and send the final report with the alert info from both time periods. | Drag a Reducer unit to the canvas and configure it as follows:
| |||
Email Sink | We will use this unit to send the reports generated to the required user emails. | Drag an Email Sink unit to the canvas and configure it as follows:
|
Links
Once you have added and configured all the units of the Flow, you must link them as follows:
Step 1 | |
---|---|
First, you must link the out port of the Generator unit to the reset port of the second Reducer unit (combineMessages). This first step is required to reset the final Reducer every time the Flow is activated. This unit will store and combine the data to be sent in the report, so we need to reset it before the next report is generated. | |
Step 2 | |
Then, we must define the links to feed the final Reducer unit with the alert information for the first period of time (last 24 hours). To do it, create the following links:
| |
Step 3 | |
Now, we must define the links to feed the final Reducer unit with the alert information for the second period of time (same day and hour but a week before). To do it, create the following links:
| |
Step 4 | |
Finally, when the second Reducer has the information from both time periods, it will be sent via email to the required recipients. To do it:
|
Result
Once you're done, remember to save your Flow so you can start running it. To do it, click the Save button on the Flow toolbar.
Once you have defined the whole Flow and saved it, click the Start button to activate it. If everything is correctly configured, the Flow will send an email to the given addresses with a report comparing the alert count over the last hour with the alert count over the same hour and day of the previous week.
Import this Flow
Download this Flow in JSON format by clicking here and import it to your domain clicking the Import option at the top of the Flow canvas. If the JSON object opens on a new browser window automatically, copy all the content, paste it into your notepad and save it in .txt or .json format.
Remember to add the required target email addresses as explained above before running the Flow.
[ Description ] [ Flow configuration ] [ Result ] [ Import this Flow ]
Description
A Flow that pulls an alert count from 2 different time periods, combines and transforms it into a specific format, and sends a report with the results via email to the required recipients.
This Flow checks the number of alerts triggered in the last hour and compares them with the alerts received over the same day and hour of the previous week. The info comparing both alert counts is sent via email every x minutes. To get this, the Flow is made up of 2 different branches:
- The top branch counts the alerts triggered over the last hour.
- The bottom branch counts the alerts triggered over the same hour, seven days previously.
Execution order in Flow
In Flows with different branches like this one, note that branches are always executed in a specific sequential order. You can check the order by hovering over the links that go out from a specific port and checking the number that appears. In this specific Flow, we need the top branch to be executed before the other one.
To change the execution order, click a link, select the arrows icon that appears and click the top or bottom arrow button to set the order of that link higher or lower. Learn more about this in Working with links.
Flow configuration
The following table describes the units needed to create this Flow, as well as how to configure and link them.
Unit type | Description | Configuration | |||
---|---|---|---|---|---|
Generator | This unit will fire an event every x minutes (in this example, every minute). We will enrich these events using the following units and will use them to activate the required queries. |
| |||
Map | We will use a couple of Map units to enrich the events with time information. As said above, we will be comparing alerts triggered the last hour with alerts triggered over the same day and hour of the previous week. To do it, we will use these Map units to specify the start and end date of each period. | Drag 2 Map units to the canvas and link their in ports to the out port of the Generator unit. As mentioned in the introduction of this article, Flows follow a sequential order. In this case, we want the top branch of the Flow to activate before the bottom want. To do this, you must first link the Generator unit to the top Map (prepareQueryTimeInterval), and then to the bottom one (preparePastQueryTimeInterval). As said above, you can always change the execution order by clicking a link, selecting the arrows icon that appears, and clicking the top or bottom arrow button to set the order of that link higher or lower. Learn more about this in Working with links. Now follow the steps below to configure both units:
| |||
Devo Full Query | We will use a couple of Devo Full Query units to specify the query that defines the alerts to be compared. We will be querying the | Drag 2 Devo Full Query units to the canvas and link their in ports to the out ports of the Map units, as follows: Now follow the steps below to configure both units:
| |||
Reducer | We will use a couple of Reducer units to store all the events received during the query periods set, combine and format them and finally emit an only event with all the alerts triggered during those periods. | Drag 2 Reducer units to the canvas and link them to the Devo Full Query units as follows:
Now follow the steps below to configure both units:
| |||
Reducer | We will use an additional Reducer to combine the information stored by the previously added Reducer units and send the final report with the alert info from both time periods. |
| |||
Email Sink | We will use this unit to send the reports generated to the required user emails. |
|
Once you're done, remember to save your Flow so you can start running it. To do it, click the Save button on the Flow toolbar.
Result
Once you have defined the whole Flow and saved it, click the Start button to activate it. If everything is correctly configured, the Flow will send an email to the given addresses with a report comparing the alert count over the last hour with the alert count over the same hour and day of the previous week.
Import this Flow
Download this Flow in JSON format by clicking here and import it to your domain clicking the Import option at the top of the Flow canvas. If the JSON object opens on a new browser window automatically, copy all the content, paste it into your notepad and save it in .txt or .json format.
Remember to add the required target email addresses as explained above before running the Flow.
See the following video to learn more about version #1 of this Flow: