- Splunk Answers
- :
- Using Splunk
- :
- Alerting
- :
- Re: How to display the selected text from log obta...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to display the selected text from log obtained from search in a subject of email while creating an alert ??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try to bring the value in top of the result table and use $result.fieldname$ in the subject while setting up the alert where the fieldname is the name of the field that the value is.
If your query does not produce the desired value in the results table try appendcols and join the value to the query.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I can't use $result.fieldname$ since the text which I want to display as subject is not part of field of log.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can add new fields to your results as you need. | eval subject="This is a test subject" You could then use $result.subject$ in your alert.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try extracting the value through field extraction given by Splunk or by using regex ( rex command )
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How are you getting that app name then?? A lookup?? Hardcoded/static value??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
app name is name given to particular section of text of log, however there is not such field name appname in either selected field or interesting field of result obtained by triggering queries.
My query is like this,
APP1 OR APP2 OR APP3 java.io.IOException
so whenever this pattern is occurred a new alert will be raised.
alert are getting raised perfectly but we're unable to identified for which APP we're getting that particular error.
suppose alert is raised is raised due to failure of APP2 so we expect APP2 name in our subject of Alert.
as suggested by @nawazns5038, use $result.fieldname$ to extract appname and displayed it to subject but unfortunately whenever we trigger this query we don't get that selected text which we want to display as subject as selected field or interesting field.
We can create 3 separate alert for each app and email subject as hardcode app, but I think this is very redundant and unnecessary.
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
