How do you alert output and result variables?

damucka — Tue, 29 Sep 2020 23:55:01 GMT

Hello,

I have the following search in my alert:

index=mlbso sourcetype=BWP_hanatraces "long running cursor detected" AND "CANCEL REQUESTED"  
| eval DBSID="TEST" 
| rex field=IDLE_TIME "(?<idletime>\d+) sec" 
| eventstats max(idletime) as MAX_IDLE_TIME 
| eval MAX_IDLE_TIME =tostring(MAX_IDLE_TIME ,"duration")
| lookup email_groups.csv DBSID OUTPUT email_recipients AS email_recipients
| sort - IDLE_TIME
| table _time DBSID CONNECTION_ID CONNECTION_STATUS IDLE_TIME MAX_IDLE_TIME HOST email_recipients

Then I would like to use the following fields in my alert subject and e-mail recipient list:

$result.DBSID$
$result.MAX_IDLE_TIME$
$result.email_recipients$

With the above search it works fine, but what is not nice is that, in the result table also the long list of the e-mail addresses appears. However when I delete it from the table command, then the corresponding variable (email_recipients) does not get transferred to the alert and e-mail is not sent / does not reach the recipients.

How would I transfer the email_recipients to the alert $result.email_recipients$ of the alert, but does not show it in the output itself?

Is it possible?

Kind Regards,
Kamil

Re: How do you alert output and result variables?

woodcock — Tue, 02 Apr 2019 03:56:48 GMT

Make the email_recipients invisible like this:

... | rename email_recipients AS _email_recipients
...  $result._email_recipients$

Re: How do you alert output and result variables?

damucka — Tue, 02 Apr 2019 07:54:35 GMT

Perfect, thank you !!!

topic How do you alert output and result variables? in Alerting

How do you alert output and result variables?

Re: How do you alert output and result variables?

Re: How do you alert output and result variables?