topic Re: Data missing in Alert search in Alerting

Data missing in Alert search

MScottFoley — Wed, 28 Apr 2021 20:42:04 GMT

I am doing an audit on Splunk alerts. One of the things I am looking for is if the Alert name is in the subject of the email that gets sent. I run the search at the bottom of this message and parse that. There are hundreds of alerts and most of them have one of these two settings.

"action.email.subject.alert": "$name$"
"action.email.subject": "$name$"

I don't know the difference between the two, but they seem to match proper alert setups in the GUI. There are a few dozen alerts that don't return either of these though. When I look at one of those alerts in the GUI it has the correct setting for the alert. The email subject is $name$.

Why don't these Alerts that seem to be configured correctly return the "action.email.subject" field?

Thanks,

I have even run the search where I return all fields and can't find another that looks like it would be the subject field.

Search:
|rest/servicesNS/-/-/saved/searches | search alert.track=1
| fields title Action.email.to Action.email.subject Action.email.subject.alert

Splunk 7.3.3

Re: Data missing in Alert search

tscroggins — Wed, 28 Apr 2021 23:13:56 GMT

@MScottFoley

Do you see $name$ for the alerts in the GUI, or do you see Splunk Alert: $name$? The default subject values come from $SPLUNK_HOME/etc/system/default/alert_actions.conf:

[email]
# ...
subject = Splunk Alert: $name$
subject.alert = Splunk Alert: $name$
subject.report = Splunk Report: $name$

Re: Data missing in Alert search

MScottFoley — Thu, 29 Apr 2021 13:59:44 GMT

I looked at a couple that were not showing up and they did have "Splunk Alert: $name$" as the subject. When I looked at the output from the search I did not see any with Splunk Alert: $name$. This leads me to believe that any alert missing the value is set to the default. I'll do a couple of tests to see it that holds true.

Thanks.