topic Re: Email Alert - Result tokens in Dashboards & Visualizations

Can I use a field as a token without it showing on the search?

maffreitas — Wed, 23 Feb 2022 19:01:42 GMT

Can I use a field as a token without it showing on the search?

For example:
index=idx_abc sourcetype=src_a TOTAL > 10 | table Col1 Col2 Col3

I want to use $result.TOTAL$. In other words, I want refer to a column without show it on the search results.

Re: Email Alert - Result tokens

cmerriman — Wed, 19 Oct 2016 16:23:01 GMT

Try this (put TOTAL in the table but use under options):

  <row>
    <panel>
      <table>
        <title>TITLE</title>
        <search>
          <query>index=idx_abc sourcetype=src_a TOTAL > 10 | table Col1 Col2 Col3 TOTAL </query>
        <set token="total">$result.TOTAL$</set>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
        <fields>["Col1","Col2","Col3"]</fields>
      </table>
    </panel>
  </row>

Re: Email Alert - Result tokens

maffreitas — Wed, 19 Oct 2016 16:30:47 GMT

Hi @cmerriman, thank you.

It unfortunately does not work, because if try to use the the $result.TOTAL$ this value comes empty on the email.

Re: Email Alert - Result tokens

cmerriman — Wed, 19 Oct 2016 16:33:43 GMT

you might need to do:

<done>
<set token="total">$result.TOTAL$</set>
</done>

<preview>
<set token="total">$result.TOTAL$</set>
</preview>

something to help troubleshoot tokens is to use showtokens.js to see if the token is being created/evaluated correctly.

Re: Email Alert - Result tokens

maffreitas — Wed, 19 Oct 2016 16:44:15 GMT

@cmerriman, thank you again.

I got your point, but by default I can't use simpleXML on email alert notification, can I?
(http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/EmailNotificationTokens)

Re: Email Alert - Result tokens

cmerriman — Wed, 19 Oct 2016 18:29:09 GMT

Sorry, I was thinking through dashboards and not alerts. I think the field has to be available for you to use it in your alert.

Re: Email Alert - Result tokens

weidertc — Fri, 13 Nov 2020 20:07:37 GMT

If you prefix the token name with an underscore it will hide it from the table, but the information is still present for you to use. You will still need to put it in the final table.

This command will contain the data for all 4 fields, but it will only visibly show you the 3 without leading underscores.

| table _TOTAL Col1 Col2 Col3

This token will be available for you to use.

$result._TOTAL$

Re: Email Alert - Result tokens

grywiner51 — Wed, 23 Feb 2022 18:55:42 GMT

This is the way. Thank you weidertc!