Alerting

Email Alert Subject

hjwang
Contributor

Dear Splunkers:

Is there any way to add extra search result field value to alert email subject? like host value
Thanks in advance!!

Tags (2)

rturk
Builder

From what I've read, it supports $name$ and the name of the saved search, and $seach$ as the search string itself.

You can configure scripted alerts as per as alert_actions.conf#Script_options, but you're constrained by these 8:

SPLUNK_ARG_0 Script name
SPLUNK_ARG_1 Number of events returned
SPLUNK_ARG_2 Search terms
SPLUNK_ARG_3 Fully qualified query string
SPLUNK_ARG_4 Name of saved search
SPLUNK_ARG_5 Trigger reason (for example, "The number of events was greater than 1")
SPLUNK_ARG_6 Browser URL to view the saved search
SPLUNK_ARG_8 File in which the results for this search are stored (contains raw results)

If you want to use hosts, then I think you're going to have to play around with custom scripted inputs.

Check this link out as well, which can point you in the right direction: http://splunk-base.splunk.com/answers/34570/how-to-add-custom-email-alert-content

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...