Alerting

How should tokens be used to include values of a multi-row search result in my email alert's subject line?

bharadwaja30
Explorer

I want to trigger an email alert when disk usage of any of my servers exceeds 70%. For that, I have written a search query that lists down all the servers that exceeded 70% usage, in a tabular format. Fine. Now I want to include the values of this multi row search result in my mail's subject. How can I make use of tokens to include the values of multi-row search result in my mail's subject?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi bharadwaja30,
see https://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/EmailNotificationTokens
every way, with $result.fieldname$ you can insert the first occurrence of your search.
You can also insert a link to the results (there is a check button)
beware to the number of results in your eMail, because if they are too many you could exceed the eMail dimensions limits.
Bye.
Giuseppe

0 Karma

bharadwaja30
Explorer

Hi cusello,

Thank you for responding to my question.

Yeah, $result.fieldname$ gives only the first occurrence of search. That is, the value in the first row of that particular fieldname column. My question is, how to send the values in the 2nd,3rd.. rows of the same column using tokens? Hope you got my question.

thomasneat
Engager

I can't find an answer to this either and it's been 3 years since this one was asked.

0 Karma

dailv1808
Path Finder

me too, Splunk not support maybe

0 Karma

skjaki786
Observer

I have tried multiple options to show multiple values of single fields from 1st panels output to 2nd panels

it didn't work. I don't see any official documents. 

Is there any expert can suggest on this?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. Calling specific people to answer your question is plain rude. This is a volunteer-driven community and people respond to publicly posted question if/when they want. If you want a response in a timely manner - you have to purchase some support/consultancy services from one of many Splunk partners or Splunk's own Professional Services.

2. Digging up a thread from 5 years ago is not very likely to produce meaningful results. Create a new thread, describe your problem. If your problem is similar to an old one, you could link to the old one for reference.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...