Alerting

How should tokens be used to include values of a multi-row search result in my email alert's subject line?

bharadwaja30
Explorer

I want to trigger an email alert when disk usage of any of my servers exceeds 70%. For that, I have written a search query that lists down all the servers that exceeded 70% usage, in a tabular format. Fine. Now I want to include the values of this multi row search result in my mail's subject. How can I make use of tokens to include the values of multi-row search result in my mail's subject?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi bharadwaja30,
see https://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/EmailNotificationTokens
every way, with $result.fieldname$ you can insert the first occurrence of your search.
You can also insert a link to the results (there is a check button)
beware to the number of results in your eMail, because if they are too many you could exceed the eMail dimensions limits.
Bye.
Giuseppe

0 Karma

bharadwaja30
Explorer

Hi cusello,

Thank you for responding to my question.

Yeah, $result.fieldname$ gives only the first occurrence of search. That is, the value in the first row of that particular fieldname column. My question is, how to send the values in the 2nd,3rd.. rows of the same column using tokens? Hope you got my question.

thomasneat
Engager

I can't find an answer to this either and it's been 3 years since this one was asked.

0 Karma

dailv1808
Path Finder

me too, Splunk not support maybe

0 Karma

skjaki786
Observer

I have tried multiple options to show multiple values of single fields from 1st panels output to 2nd panels

it didn't work. I don't see any official documents. 

Is there any expert can suggest on this?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. Calling specific people to answer your question is plain rude. This is a volunteer-driven community and people respond to publicly posted question if/when they want. If you want a response in a timely manner - you have to purchase some support/consultancy services from one of many Splunk partners or Splunk's own Professional Services.

2. Digging up a thread from 5 years ago is not very likely to produce meaningful results. Create a new thread, describe your problem. If your problem is similar to an old one, you could link to the old one for reference.

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...