topic Re: How do you Include a search string in a Splunk email PDF delivery? in Reporting

How do you Include a search string in a Splunk email PDF delivery?

cboonyan — Tue, 09 Oct 2018 01:01:17 GMT

I am intending to schedule Splunk email delivery. Is it possible to display the search string inside this generated pdf?

Re: How do you Include a search string in a Splunk email PDF delivery?

iamarkaprabha — Tue, 09 Oct 2018 05:45:40 GMT

Hi cboonyan,

If you are looking for email notification for an alert or scheduled report then it can be possible to include the search strings.
If you are thinking of delivering the dashboard in PDF then probably i have to check again

Re: How do you Include a search string in a Splunk email PDF delivery?

inventsekar — Tue, 09 Oct 2018 06:49:08 GMT

Hi.. you can edit the report and choose the "Trigger Actions" ---> Send Mail ----> under the "Include" area, select the "Search String", save the report. this will resolve your task. if any issues, let us know. thanks.

(Please, once issue resolved, you can upvote/accept as answer, so that the question will be marked as resolved)

Re: How do you Include a search string in a Splunk email PDF delivery?

mstjohn_splunk — Tue, 09 Oct 2018 19:46:17 GMT

hi @cboonyan

Did either of the answers below solve your problem? If so, please resolve this post by approving one of them.
If your problem is still not solved, keep us updated so that someone else can help ya.

Thanks!

Re: How do you Include a search string in a Splunk email PDF delivery?

cboonyan — Thu, 11 Oct 2018 07:51:51 GMT

thanks for your response, I have checked and there isn't the Include: Search String option in the send mail pop up form. I am guessing it is due to the version of splunk I'm using, which unfortunately upgrading it is out of my control. Will I be able to use the dashboard source to include the search string using the tags?

Re: How do you Include a search string in a Splunk email PDF delivery?

jvardev — Thu, 11 Oct 2018 09:16:53 GMT

Hi @cboonyan ,

Try include predefined tokens in your report without use options form. Token $search$ contains the search.
Find more info and full token list on doc:

http://docs.splunk.com/Documentation/Splunk/7.1.2/AdvancedDev/ModAlertsLog

Greetings. jvardev.

Re: How do you Include a search string in a Splunk email PDF delivery?

inventsekar — Thu, 11 Oct 2018 11:54:43 GMT

ok then, if your query is resolved, can you please accept this as the answer.. so that it will be marked as the answered question.

Re: How do you Include a search string in a Splunk email PDF delivery?

cboonyan — Fri, 12 Oct 2018 03:04:57 GMT

hi, I have tried to include $search$ into the message field according to http://docs.splunk.com/Documentation/Splunk/6.5.5/Alert/EmailNotificationTokens. However, when I sent a test email, the token resolves to nothing. The default $name$ token however resolves to something. I have tried both report into dashboard and inline report panel but both exhibits same blank result for $search$.