topic Email Alert in Alerting

Email Alert

nebyouadane — Mon, 28 Sep 2020 15:27:32 GMT

GM
I created an email alert, but my result comes back with the query and error code or it says "A PDF snapshot has been generatedm for the view" I would like to get a table or a chart in the email. I'm using Splunk Enterprise 5.0.5. this is for Failed Login Alert, below you see the query I wrote. I get the right result on splunk but not in my email.

(eventtype=msad-failed-user-logons | fields src_host,src_ip,src_nt_domain,user | eval src_ip=replace(src_ip,"::ffff:","") | ip-to-host | stats values(src_nt_domain) AS "Domain(s)", count AS Count, values(src_host) AS "Host(s)", values(src_ip) AS "IP(s)", sparkline AS "Failure activity" by user | sort -Count | rename user as "Username"
)

Re: Email Alert

kristian_kolb — Tue, 10 Dec 2013 19:02:42 GMT

did you read this?

http://docs.splunk.com/Documentation/Splunk/5.0.5/Alert/Definescheduledalerts

or this;

http://docs.splunk.com/Documentation/Splunk/5.0.5/Alert/Setupalertactions

Re: Email Alert

nebyouadane — Tue, 10 Dec 2013 23:59:07 GMT

Thanks, it worked

Re: Email Alert

nebyouadane — Fri, 13 Dec 2013 19:32:03 GMT

Thanks, it worked