topic Re: ITSI tracked alert events does not show the field to be able to use it in email alert in Splunk ITSI

ITSI tracked alert events does not show the field to be able to use it in email alert

abhi04 — Thu, 31 Jul 2025 19:03:29 GMT

I have a KPI for Instance status:

index=xxxxx source="yyyyy"
| eval UpStatus=if(Status=="up",1,0)
| stats last(UpStatus) as val by Instance host Status

Now the val is 0 or 1 and Status field is Up or Down

The split by field is Instance host
and threshold is based on val

The alert triggers fine but I want to put the field in email alert $result.Status$ Instead of $result.val$
But I dont see the field Status in tracked alerts. How can I make this field Status shows in tracked alerts index or events generated so that I can use it in my email (This is to avoid confusuion, instead of saying 0, 1 it will say up or down)

Re: ITSI tracked alert events does not show the field to be able to use it in email alert

livehybrid — Thu, 31 Jul 2025 20:06:59 GMT

Hi @abhi04

Are you using Aggregation Policies to trigger your alerts, or KPI Alerts?

Im not sure how to achieve this with KPI Alerts, but if you are using aggregation policies then you might be able to add some logic in here (similar to how you would apply a lookup) to do an eval based on the value.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: ITSI tracked alert events does not show the field to be able to use it in email alert

PrewinThomas — Fri, 01 Aug 2025 04:50:33 GMT

@abhi04

Try to include Status field explicitly,

index=xxxxx source="yyyyy" | eval UpStatus=if(Status=="up",1,0) | stats last(UpStatus) as val, latest(Status) as Status by Instance host

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: ITSI tracked alert events does not show the field to be able to use it in email alert

abhi04 — Sat, 02 Aug 2025 20:36:17 GMT

Hi @livehybrid

This KPI is used by different service for their Instance down alert as KPI metric and I am using aggregation policies for these services to trigger email alert.

I don't see any option to include this field from NEAPs.

Also,

even changing the query does not help, as its is not creating any field Status in its events which I can refer.

index=xxxxx source="yyyyyy"
| eval UpStatus=if(Status=="up",1,0)
| stats last(UpStatus) as val last(Status) as Status by Instance host

Re: ITSI tracked alert events does not show the field to be able to use it in email alert

skramp — Mon, 22 Sep 2025 09:41:25 GMT

first, you should avoid using stats commands while creating KPIs, sometimes it's not possible but in this case you can do all the stats-magic in the KPI calculation. After this, your alarms will be in the index itsi_tracked_alerts. When you have those alerts, they must be put into Episode(s) by a Notable Event Aggregation Policy. With this NEAP you bundle events by a specific criteria. And when you process events you can also trigger something by this NEAP like sending a email. You can use a lookup to figure out, which email should be used ie by hostname or department or whatever.