Include hostname in alert email subject

[sruff]

I'm looking for a way to include the hostname in an alert email subject. Our pager system ignores multiple alerts with same subject so it is possible to miss alerts from multiple hosts with same issue.

Thanks for reading.

[mmccul]

Put the token $result.host$ in the subject section of the alert configuration.

See http://docs.splunk.com/Documentation/Splunk/6.2.3/Alert/Setupalertactions for more details.

[sruff]

Thanks for the quick reply. I've tested and this solution does not work. I've tested with token "$result.host$" and "$result.src_host$".

My saved search is as follows:
Search
tag::host="atg" tag::host="prod1" source=*/server.log TESTING--SRUFF
Email subject
Splunk Alert: $name$ $result.host$

Latest alert email subject line has "Splunk Alert: <saved search name>" but does not include the hostname of from the server who's log contained the search text. I was expecting to see "Splunk Alert: <saved search name> <server name>".

Thanks.

[mmccul]

Just for sanity's sake, see if that token works for you in the alert body.

$result.host$ means insert from the results, the value of the field named host. There are some oddities for some cases in that token, but source and host should just work.

[sruff]

I'm not seeing where you can modify the body of the email.

I tested with Subject: "Splunk Alert: $name$ $results.count$" which returns the proper count. Auto included in the body of the email has the below columns and under the index column it does list the correct hostname
_raw _time host index linecount source sourcetype splunk_server tag::host

[martin_mueller]

You can use $result.host$ in your alert emails: http://docs.splunk.com/Documentation/Splunk/6.2.3/Alert/Setupalertactions#Use_tokens_in_email_notifi...

[martin_mueller]

Upgrading is fairly painless...

[martin_mueller]

Using search results as tokens in Email alerts is only available from 6.1 and up 😞

[sruff]

Aww man. Ok thanks for the help.

[martin_mueller]

What Splunk version are you using?

[sruff]

version 5.0.3, build 163460