Alerting

How do you alert output and result variables?

damucka
Builder

Hello,

I have the following search in my alert:

index=mlbso sourcetype=BWP_hanatraces "long running cursor detected" AND "CANCEL REQUESTED"  
| eval DBSID="TEST" 
| rex field=IDLE_TIME "(?<idletime>\d+) sec" 
| eventstats max(idletime) as MAX_IDLE_TIME 
| eval MAX_IDLE_TIME =tostring(MAX_IDLE_TIME ,"duration")
| lookup email_groups.csv DBSID OUTPUT email_recipients AS email_recipients
| sort - IDLE_TIME
| table _time DBSID CONNECTION_ID CONNECTION_STATUS IDLE_TIME MAX_IDLE_TIME HOST email_recipients

Then I would like to use the following fields in my alert subject and e-mail recipient list:

$result.DBSID$
$result.MAX_IDLE_TIME$
$result.email_recipients$

With the above search it works fine, but what is not nice is that, in the result table also the long list of the e-mail addresses appears. However when I delete it from the table command, then the corresponding variable (email_recipients) does not get transferred to the alert and e-mail is not sent / does not reach the recipients.

How would I transfer the email_recipients to the alert $result.email_recipients$ of the alert, but does not show it in the output itself?

Is it possible?

Kind Regards,
Kamil

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Make the email_recipients invisible like this:

... | rename email_recipients AS _email_recipients
...  $result._email_recipients$

View solution in original post

0 Karma

woodcock
Esteemed Legend

Make the email_recipients invisible like this:

... | rename email_recipients AS _email_recipients
...  $result._email_recipients$
0 Karma

damucka
Builder

Perfect, thank you !!!

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...