topic I want to use "$result." in my alert messages, but it doesn't work. in Alerting

I want to use "$result." in my alert messages, but it doesn't work.

davidpaper — Wed, 11 Nov 2015 22:23:42 GMT

I want to run a search and include $result.sourcetype$ in my alert email, but it doesn't work.

http://docs.splunk.com/Documentation/Splunk/6.3.0/Alert/Emailnotification says it should.

Help!

Re: I want to use "$result." in my alert messages, but it doesn't work.

davidpaper — Wed, 11 Nov 2015 22:26:13 GMT

If you want to use "$result." in your alert messages (either in the subject or the body), then there are a set of commands called transforming commands that you can’t use. They are listed here:

http://docs.splunk.com/Splexicon:Transformingcommand

So, a very simple search that would allow you to include “$result.source$” in your Subject or email body would be something like:

index=foo | head 1

But if you tried to do:

index=foo | stats count

none of the $result.*$ values are available.

A request to update docs has been submitted.

Re: I want to use "$result." in my alert messages, but it doesn't work.

dmwyss — Tue, 29 Oct 2019 03:59:28 GMT

I had the problem that when I was using tokens from the search, no email would be sent.
Then I discovered a typo in a different field.
Once I resolved the - seemingly unrelated - problem it started working again.