Alerting

Can we add specific text in Alerts

xvxt006
Contributor

Hi,

We would like to add alert specific contextual information. is it possible to modify each alert to have custom text in there?

Tags (2)
0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

If you are using the alert to send an email, you can customize the email message with any text you want, as well as tokens to include variables from the search that generated the alert. See Set up alert actions > Email notification in the Alerting Manual.

View solution in original post

stephane_cyrill
Builder

You can create a contextual message for your alert and populate the event corresponding to the alert and the message in and index where you will go and retrieve them after.

to do that you have to buid your alert like this:

|Eval message= or < if(.......) > |table message otherfields|collect index youIndex

after setting your alert as you like where the alert will be triggered, you will have it in yourIndex with your message.

stephane_cyrill
Builder

feel free to vote and accept .....

0 Karma

ChrisG
Splunk Employee
Splunk Employee

If you are using the alert to send an email, you can customize the email message with any text you want, as well as tokens to include variables from the search that generated the alert. See Set up alert actions > Email notification in the Alerting Manual.

xvxt006
Contributor

Nice...Thank you..

0 Karma

stephanefotso
Motivator

Only if you want to send an email message, you can add a message

SGF
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...