Custom Alert Setup

mahesh27 — Mon, 26 Aug 2024 18:55:49 GMT

We are using the below query for our alert, when we receive mail we want to see MESSAGE in Alert title.
In subject we give Splunk Alert: $name$. in this place when the alert is triggered we want to view that Messages in the alert title.
We tried giving Splunk Alert: $result.Message$, here only 1 message is showing up not all.
how can we do it???

Query:

index=app-index "ERROR" |eval Message=case( like(_raw, "%internal error system%"), "internal error system", like(_raw, "%connection timeout error%"), "connection timeout error", like(_raw, "%connection error%"), "connection error", like(_raw, "%unsuccessfull application%"), "unsuccessfull application", like(_raw, "%error details app%"), "error details app", 1=1, null()) |stats count by Message |eval error=case( Message="internal error system" AND count >0,1, Message="connection timeout error" AND count >0,1, Message="connection error" AND count >0,1, Message="unsuccessfull application" AND count >0,1, Message="error details app" AND count >0,1) |search error=1

Re: Custom Alert Setup

richgalloway — Mon, 26 Aug 2024 19:10:19 GMT

When including a results field in an alert, only the first result is included. There is no way to include anything other than the first result.

topic Re: Custom Alert Setup in Dashboards & Visualizations

Custom Alert Setup

Re: Custom Alert Setup