https://community.splunk.com/t5/Dashboards-Visualizations/Pass-string-token-to-email-alert-text/m-p/483186#M31678 <P>I have a search<BR /> "%UC_CALLMANAGER-6-DeviceUnregistered" "DeviceType=90" OR "DeviceType=73"</P> <P>Which correctly matches the below entry and I have an alert so send an email notification. I would like to pass a string from the syslog text (DeviceName=JK-Test) in the email message but can’t seem to get it pass. When I expand the syslog in search it says DeviceName is JK-Test. In my email message I have tried:</P> <P>email text:<BR /> $Result.DeviceName$ test line 1<BR /> "$event.DeviceName$" test line 2<BR /> $DeviceName$ test line 3<BR /> $result.devicename$ test line 4</P> <P>Is there a format to where I can pass that info?</P> <P>search result:<BR /> Feb 25 16:17:26 myserver.local Feb 25 2020 22:17:26.527 UTC : %UC_CALLMANAGER-6-DeviceUnregistered: %[DeviceName=JK-Test][IPAddress=1.1.1.1][Protocol=RouteList][DeviceType=90][Description=Test Hunt Group][Reason=8][IPAddrAttributes=0][AppID=Cisco CallManager][ClusterID=StandAloneCluster][NodeID=myserver]: Device unregistered</P> Wed, 26 Feb 2020 14:44:14 GMT jdrohen 2020-02-26T14:44:14Z https://community.splunk.com/t5/Dashboards-Visualizations/Pass-string-token-to-email-alert-text/m-p/483186#M31678 <P>I have a search<BR /> "%UC_CALLMANAGER-6-DeviceUnregistered" "DeviceType=90" OR "DeviceType=73"</P> <P>Which correctly matches the below entry and I have an alert so send an email notification. I would like to pass a string from the syslog text (DeviceName=JK-Test) in the email message but can’t seem to get it pass. When I expand the syslog in search it says DeviceName is JK-Test. In my email message I have tried:</P> <P>email text:<BR /> $Result.DeviceName$ test line 1<BR /> "$event.DeviceName$" test line 2<BR /> $DeviceName$ test line 3<BR /> $result.devicename$ test line 4</P> <P>Is there a format to where I can pass that info?</P> <P>search result:<BR /> Feb 25 16:17:26 myserver.local Feb 25 2020 22:17:26.527 UTC : %UC_CALLMANAGER-6-DeviceUnregistered: %[DeviceName=JK-Test][IPAddress=1.1.1.1][Protocol=RouteList][DeviceType=90][Description=Test Hunt Group][Reason=8][IPAddrAttributes=0][AppID=Cisco CallManager][ClusterID=StandAloneCluster][NodeID=myserver]: Device unregistered</P> Wed, 26 Feb 2020 14:44:14 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Pass-string-token-to-email-alert-text/m-p/483186#M31678 jdrohen 2020-02-26T14:44:14Z https://community.splunk.com/t5/Dashboards-Visualizations/Pass-string-token-to-email-alert-text/m-p/483187#M31679 <P>Take a look at <A href="https://answers.splunk.com/answers/342128/why-does-resultfieldname-token-not-work-in-alert-e.html">https://answers.splunk.com/answers/342128/why-does-resultfieldname-token-not-work-in-alert-e.html</A></P> Thu, 27 Feb 2020 02:03:57 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Pass-string-token-to-email-alert-text/m-p/483187#M31679 masonmorales 2020-02-27T02:03:57Z