topic Re: Include hostname in alert email subject in Alerting

Include hostname in alert email subject

sruff — Thu, 14 May 2015 15:41:10 GMT

I'm looking for a way to include the hostname in an alert email subject. Our pager system ignores multiple alerts with same subject so it is possible to miss alerts from multiple hosts with same issue.

Thanks for reading.

Re: Include hostname in alert email subject

martin_mueller — Thu, 14 May 2015 15:52:43 GMT

You can use $result.host$ in your alert emails: http://docs.splunk.com/Documentation/Splunk/6.2.3/Alert/Setupalertactions#Use_tokens_in_email_notifications

Re: Include hostname in alert email subject

mmccul — Thu, 14 May 2015 15:52:58 GMT

Put the token $result.host$ in the subject section of the alert configuration.

See http://docs.splunk.com/Documentation/Splunk/6.2.3/Alert/Setupalertactions for more details.

Re: Include hostname in alert email subject

sruff — Thu, 14 May 2015 17:17:52 GMT

Thanks for the quick reply. I've tested and this solution does not work. I've tested with token "$result.host$" and "$result.src_host$".

My saved search is as follows:
Search
tag::host="atg" tag::host="prod1" source=*/server.log TESTING--SRUFF
Email subject
Splunk Alert: $name$ $result.host$

Latest alert email subject line has "Splunk Alert: <saved search name>" but does not include the hostname of from the server who's log contained the search text. I was expecting to see "Splunk Alert: <saved search name> <server name>".

Thanks.

Re: Include hostname in alert email subject

mmccul — Thu, 14 May 2015 17:21:23 GMT

Just for sanity's sake, see if that token works for you in the alert body.

$result.host$ means insert from the results, the value of the field named host. There are some oddities for some cases in that token, but source and host should just work.

Re: Include hostname in alert email subject

sruff — Mon, 28 Sep 2020 19:58:02 GMT

I'm not seeing where you can modify the body of the email.

I tested with Subject: "Splunk Alert: $name$ $results.count$" which returns the proper count. Auto included in the body of the email has the below columns and under the index column it does list the correct hostname
_raw _time host index linecount source sourcetype splunk_server tag::host

Re: Include hostname in alert email subject

martin_mueller — Thu, 14 May 2015 17:45:19 GMT

What Splunk version are you using?

Re: Include hostname in alert email subject

sruff — Thu, 14 May 2015 17:48:30 GMT

version 5.0.3, build 163460

Re: Include hostname in alert email subject

martin_mueller — Thu, 14 May 2015 17:49:59 GMT

Using search results as tokens in Email alerts is only available from 6.1 and up 😞

Re: Include hostname in alert email subject

sruff — Thu, 14 May 2015 18:00:28 GMT

Aww man. Ok thanks for the help.

Re: Include hostname in alert email subject

martin_mueller — Thu, 14 May 2015 18:02:51 GMT

Upgrading is fairly painless...