topic Re: Email from Splunk in Splunk Search

Email from Splunk

viksvig — Wed, 24 Nov 2021 20:49:58 GMT

I have splunk search - index=cloud EventName: "Error Occurred" XChangeToSalesForce | rename message as "Message" _time as Time | table Time,Message

When i search on splunk search, i get the below response

1637759064 Multiple Terms found for the same agency. Agency code:

But when the email is sent, i get nothing on the message field

Time	Message
1637759064

Re: Email from Splunk

johnhuang — Wed, 24 Nov 2021 20:50:10 GMT

How is the email formatted? Are you inserting the results as an inline table?

Re: Email from Splunk

viksvig — Wed, 24 Nov 2021 21:39:27 GMT

@johnhuang it is formatted as inline table, i tried inline raw as well

Re: Email from Splunk

viksvig — Mon, 29 Nov 2021 19:27:48 GMT

@johnhuang any idea why it is skipping the Messages

Re: Email from Splunk

johnhuang — Wed, 01 Dec 2021 18:05:36 GMT

Could you post a sample of the search result and also the email template config.

Re: Email from Splunk

viksvig — Wed, 01 Dec 2021 18:56:02 GMT

This is the search and I am getting the desired result here. But when Email is sent the Message field blanks out

Re: Email from Splunk

viksvig — Wed, 01 Dec 2021 18:57:02 GMT

Re: Email from Splunk

johnhuang — Wed, 01 Dec 2021 19:37:23 GMT

That's strange and interesting. Lets rule out a few things.

1. Could you enable the options "Attach CSV" and "Attach PDF"? Run another test and see if the data is in the attachments.

2. Let's replace the data in Message with safe characters and see if that works.

| eval message="testing_"._time

Re: Email from Splunk

Siddharth — Wed, 01 Dec 2021 21:49:49 GMT

Try to add the results in some log or lookup and check the output

In case if it is empty check the data and if not try to send the alert to your mail id using this

| makeresults | eval a = temp | table a _time

and use inline table in your alert