I have an alert based on the below search (obfuscated):
...
| eval APPDIR=source
| rex field=APPDIR mode=sed "s|/logs\/.*||g"
| eventstats values(APPDIR) as APPDIRS
| eval Level=if("/app/5000" IN (APPDIRS), "PRODUCTION", "Non-production")
| eval APPDIRS=mvjoin(APPDIRS, ",")
The idea is to discern the affected application-instance (there are multiple logs under each of the /app/instance/logs/) and then to determine, whether the instance is a production one or not. In the search-results all three new fields (APPDIR, APPDIRS, and Level) are populated as expected.
But they don't show up in the e-mails. The "Subject: $Level$ app in $APPDIRS$" expands to mere "Subject: app in ". Nor are the fields expanded in the body of the alert e-mail.
Now, I understand, that event-specific fields -- like the singular APPDIR above -- cannot be expected to work in an alert. But the plural APPDIRS, as well as the Level, are aggregates, aren't they?
What am I doing wrong, and how do I fix it?
