Alerting

Custom Subject for Splunk Alert

vamsi202
Engager

I'm configured an Alert to send mail whenever Error type is triggered in windows event log. I need to customize subject for that alert like server name, event type, event ID in mail.

For Example: Alert triggered for 'ServerName' with 'Event Type' and 'Event ID'

Below is the search im using.

index="wineventlog" source="wineventlog:application" SourceName="MSSQLSERVER" Type=Error
[|inputlookup inv where client_group="*SQLServer Admin*"
|fields name
|rename name as host]
| table _time,host,EventID,Type,Message
| sort _time desc

Labels (1)
0 Karma
1 Solution

rnowitzki
Builder

Hi @vamsi202 ,

You can reference fields from the search with $result.fieldname$

See https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens

Hope this helps.

BR

Ralph

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

rnowitzki
Builder

Hi @vamsi202 ,

You can reference fields from the search with $result.fieldname$

See https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens

Hope this helps.

BR

Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

vamsi202
Engager

That worked. Thanks a lot

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...