Alerting

Email Alert Subject

hjwang
Contributor

Dear Splunkers:

Is there any way to add extra search result field value to alert email subject? like host value
Thanks in advance!!

Tags (2)

rturk
Builder

From what I've read, it supports $name$ and the name of the saved search, and $seach$ as the search string itself.

You can configure scripted alerts as per as alert_actions.conf#Script_options, but you're constrained by these 8:

SPLUNK_ARG_0 Script name
SPLUNK_ARG_1 Number of events returned
SPLUNK_ARG_2 Search terms
SPLUNK_ARG_3 Fully qualified query string
SPLUNK_ARG_4 Name of saved search
SPLUNK_ARG_5 Trigger reason (for example, "The number of events was greater than 1")
SPLUNK_ARG_6 Browser URL to view the saved search
SPLUNK_ARG_8 File in which the results for this search are stored (contains raw results)

If you want to use hosts, then I think you're going to have to play around with custom scripted inputs.

Check this link out as well, which can point you in the right direction: http://splunk-base.splunk.com/answers/34570/how-to-add-custom-email-alert-content

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...