Alerting

How to combine two tokens (with NO Space) in an alert email?

Explorer

I have an email alert that I've configured that I would like to include two tokens without a space in the body of the email.

The two fields are:

&nbsp - memberntdomain = URT\
&nbsp - member = jsmith

So, I would like the output in the email formatted like this: URT\jsmith. The reason that I can't have the space is that the domain token includes the backslash - otherwise adding "\" in between the two tokens would produce the desired result.

I have tried the following, but none seem to work. (I've included the result that each produces in the section after the -->)

$result.member_nt_domain result.member$  -->  *blank*
$result.member_nt_domain$ $result.member$  -->  URT\ jsmith
$result.member_nt_domain$$result.member$  -->  $result.member_nt_domain$result.member$
$result.member_nt_domain$result.member$  -->  URT\result.member$

Thanks for the help.

0 Karma
1 Solution

Motivator
| eval domainmember = member_nt_domain.member

then use the token: $result.domainmember$

View solution in original post

Motivator
| eval domainmember = member_nt_domain.member

then use the token: $result.domainmember$

View solution in original post

Explorer

Perfect, thanks!

0 Karma

Motivator

could you do an eval in the actual search to make a new token that is exactly what you want?

Splunk Employee
Splunk Employee

Haven't tried this with the tokens themselves, but you could use an eval in your alerting search to create a new field with the combined/concatenated value and us that as the token instead.

Explorer

Thanks for the suggestion. I'm just getting start with Splunk - any chance you could provide an example of how to do this. Here is how the search is currently written. Appreciate it.

EventCode=4732 GroupName=Administrators GroupDomain=Builtin | fields *

0 Karma

Splunk Employee
Splunk Employee

See @kmaron's answer below. You can probably remove the "| fields *"