Alerting

How to get fields from second search to my alert email?

Explorer

Hi,
I have below scenario where I have query 1 which triggers the condition for my alert to fire if it fires then I want to send the O/P of 2nd query to send in email as tabular data. In that email subject I want to include the time duration of my 2nd query

index=dtefios sourcetype=dte2Fios FT=FT ErrorCode!=0000 earliest=04/20/2020:11:00:00 latest=04/20/2020:13:00:00
| bin _time span=15m
| stats count as Total, count(eval(Error
Code!="0000")) AS Failure by FT,_time
| eval Failurepercent=round(Failure/Total
100)
| table time,FT,Total,Failure,Failurepercent
| lookup ftthresholdlkp FT
| eval alert=case(some condition)
| where alert=1
| map search="search index=dte
fios sourcetype=dte2Fios FT=$FT$ earliest=04/20/2020:12:45:00 latest=04/20/2020:13:00:00 | eval STime=strftime(earliest,"%m/%d %H:%M") , ETime=strftime(latest,"%m/%d %H:%M")| eval AlertType=if($Failurepercent$>50,"RED","AMBER")|table _time,WPID,MGRID,Host,System,DIPCommand,CID,DTECommand,FT,OSS,ErrorCode,Error_Msg"

I am trying to send Subject of mail as "AMBER ALERT: Below are the failure from 04/20 12:45 TO 04/20 13:00 GMT GMT" to get I used $result.earliest$ $result.latest$ but they are coming as blank in my subject then I used eval command to create 2 fields STIME & ETime but if I add that in map search it is not returning any rows at all and also my AlertType is also not working
Can someone help me out here how can achieve above subject using my query

Labels (2)
Tags (2)
0 Karma

SplunkTrust
SplunkTrust

I've created a solution that does exactly this. I was able to do it with the Automatic Splunk Search app

  1. Build an alert and make sure it's outputting your time fields you want to pass
  2. Make it fire the "Automatic Search" alert action
  3. The alert action will house a second query which will build the report and accept tokens from the first search
  4. The tokens represent time, you simply pass these time modifiers in the second search which also has a | send_email command

https://splunkbase.splunk.com/app/3837/

0 Karma

Explorer

Any suggestion on this question pls?

0 Karma