Hello,
I have the following search in my alert:
index=mlbso sourcetype=BWP_hanatraces "long running cursor detected" AND "CANCEL REQUESTED"
| eval DBSID="TEST"
| rex field=IDLE_TIME "(?<idletime>\d+) sec"
| eventstats max(idletime) as MAX_IDLE_TIME
| eval MAX_IDLE_TIME =tostring(MAX_IDLE_TIME ,"duration")
| lookup email_groups.csv DBSID OUTPUT email_recipients AS email_recipients
| sort - IDLE_TIME
| table _time DBSID CONNECTION_ID CONNECTION_STATUS IDLE_TIME MAX_IDLE_TIME HOST email_recipients
Then I would like to use the following fields in my alert subject and e-mail recipient list:
$result.DBSID$
$result.MAX_IDLE_TIME$
$result.email_recipients$
With the above search it works fine, but what is not nice is that, in the result table also the long list of the e-mail addresses appears. However when I delete it from the table command, then the corresponding variable (email_recipients) does not get transferred to the alert and e-mail is not sent / does not reach the recipients.
How would I transfer the email_recipients to the alert $result.email_recipients$ of the alert, but does not show it in the output itself?
Is it possible?
Kind Regards,
Kamil
