Alerting

How do you properly format Splunk email alerts?

samsam48
Explorer

I'm new to Splunk, and I'm having a hard time understanding how to properly format Splunk Email Alerts. I understand that we're able to pull information from the search results to include in the email body (like a field name with: $result.fieldName$). However, this is limited to the first value of the first row of results.

What if we had 100 events from the query, and we wanted to display the values of field_A that correspond to N number of events that have another field field_B = some_field_value.

The documentation doesn't seem to discuss anything more complex than pulling out single values, and it's making it difficult to build an email alert that provides charts of diagnostic information.

Any help or useful resources to look at would be appreciated. Thanks.

0 Karma

renjith_nair
Legend

Hi @samsam48,

By $result.fieldName$ you are referring to the message field. If you want to put the entire result in the email content, you can use the Include option - the 7th option mentioned in the following documentation

http://docs.splunk.com/Documentation/Splunk/7.1.2/Alert/Emailnotification#Define_an_email_notificati...

Also you could opt to just add the link to the results or add as a PDF/csv attachments.

Hope that helps for your requirement

---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...