Alerting Email Single result

[sanjai]

Hi Splunkers,

I am working on creating custom alerts using JavaScript in Splunk. I have created the SPL for the alert and configured the definition in macros.conf as follows:

index=XXXX sourcetype=YYYY earliest=-30d latest=now
| eval ds_file_path=file_path."\\".file_name
| stats avg(ms_per_block) as avg_processing_time by machine ds_file_path
| eval avg_processing_time = round(avg_processing_time, 1) ." ms"

From the JS part, I gave the alert condition:

| search avg_processing_time >= 2

When I run the SPL in Splunk, it returns about 5 to 6 rows of results:

machine       ds_file_path                                                          avg_processing_time
Machine01  C:\Program Files\Splunk\etc\db\gdb.ds      5.3 ms
Machine02  C:\Program Files\Splunk\etc\db\rwo.ds      7.6 ms
Machine03  C:\Program Files\Splunk\etc\db\gdb.ds      7.5 ms
Machine04  C:\Program Files\Splunk\etc\db\rwo.ds      8.3 ms

However, when I send the conditions result as an alert email, it includes only one row of the result, like the one mentioned below:

machine       ds_file_path                                                          avg_processing_time
Machine01  C:\Program Files\Splunk\etc\db\gdb.ds      5.3 ms

I need to send all the populated results ( avg_processing_time >= 2) in the email. How can I achieve this? I need some guidance.

Here are the alert parameters I used:

{
'name': 'machine_latency_' + index,
'action.email.subject.alert': 'Machine latency for the ' + index + ' environment has reached an average processing time ' + ms_threshold + ' milliseconds...',
'action.email.sendresults': 1,
'action.email.message.alert': 'In the ' + index + ' environment, the machine $result.machine$ has reached the average processing time of $result.avg_processing_time_per_block$ .',
'action.email.to': email,
'action.logevent.param.event': '{"session_id": $result.machine$, "user": $result.avg_processing_time_per_block$}',
'action.logevent.param.index': index,
'alert.digest_mode': 0,
'alert.suppress': 1,
'alert.suppress.fields': 'session_id',
'alert.suppress.period': '24h',
'alert_comparator': 'greater than',
'alert_threshold': 0,
'alert_type': 'number of events',
'cron_schedule': cron_expression,
'dispatch.earliest_time': '-30m',
'dispatch.latest_time': 'now',
'description': 'XXXXYYYYYZZZZ',
'search': '|`sw_latency_above_threshold(the_index=' + index + ')`'
}

I suspect that the email action is not configured to include the entire result set. Could someone help me with how to modify the alert settings or the SPL to ensure that all results are included in the alert email?

Thanks in advance for your help!

[burwell]

What I tend to do to get all the results in email or Slack is to use stats as described here

https://community.splunk.com/t5/Reporting/Using-result-fieldname-in-email-text-body-splunk-email-ale...