Hi,
I have below scenario where I have query 1 which triggers the condition for my alert to fire if it fires then I want to send the O/P of 2nd query to send in email as tabular data. In that email subject I want to include the time duration of my 2nd query
index=dte_fios sourcetype=dte2_Fios FT=*FT Error_Code!=0000 earliest=04/20/2020:11:00:00 latest=04/20/2020:13:00:00
| bin _time span=15m
| stats count as Total, count(eval(Error_Code!="0000")) AS Failure by FT,_time
| eval Failurepercent=round(Failure/Total*100)
| table _time,FT,Total,Failure,Failurepercent
| lookup ftthresholdlkp FT
| eval alert=case(some condition)
| where alert=1
| map search="search index=dte_fios sourcetype=dte2_Fios FT=$FT$ earliest=04/20/2020:12:45:00 latest=04/20/2020:13:00:00 | eval STime=strftime(earliest,"%m/%d %H:%M") , ETime=strftime(latest,"%m/%d %H:%M")| eval AlertType=if($Failurepercent$>50,"RED","AMBER")|table _time,WPID,MGRID,Host,System,DIP_Command,CID,DTE_Command,FT,OSS,Error_Code,Error_Msg"
I am trying to send Subject of mail as "AMBER ALERT: Below are the failure from 04/20 12:45 TO 04/20 13:00 GMT GMT" to get I used $result.earliest$ $result.latest$ but they are coming as blank in my subject then I used eval command to create 2 fields STIME & ETime but if I add that in map search it is not returning any rows at all and also my AlertType is also not working
Can someone help me out here how can achieve above subject using my query
I've created a solution that does exactly this. I was able to do it with the Automatic Splunk Search app
| send_email
commandAny suggestion on this question pls?