Alerting

Include hostname in alert email subject

Explorer

I'm looking for a way to include the hostname in an alert email subject. Our pager system ignores multiple alerts with same subject so it is possible to miss alerts from multiple hosts with same issue.

Thanks for reading.

Tags (3)

Path Finder

Put the token $result.host$ in the subject section of the alert configuration.

See http://docs.splunk.com/Documentation/Splunk/6.2.3/Alert/Setupalertactions for more details.

Explorer

Thanks for the quick reply. I've tested and this solution does not work. I've tested with token "$result.host$" and "$result.src_host$".

My saved search is as follows:
Search
tag::host="atg" tag::host="prod1" source=*/server.log TESTING--SRUFF
Email subject
Splunk Alert: $name$ $result.host$

Latest alert email subject line has "Splunk Alert: <saved search name>" but does not include the hostname of from the server who's log contained the search text. I was expecting to see "Splunk Alert: <saved search name> <server name>".

Thanks.

0 Karma

Path Finder

Just for sanity's sake, see if that token works for you in the alert body.

$result.host$ means insert from the results, the value of the field named host. There are some oddities for some cases in that token, but source and host should just work.

0 Karma

Explorer

I'm not seeing where you can modify the body of the email.

I tested with Subject: "Splunk Alert: $name$ $results.count$" which returns the proper count. Auto included in the body of the email has the below columns and under the index column it does list the correct hostname
raw _time host index linecount source sourcetype splunkserver tag::host

0 Karma

SplunkTrust
SplunkTrust

SplunkTrust
SplunkTrust

Upgrading is fairly painless...

0 Karma

SplunkTrust
SplunkTrust

Using search results as tokens in Email alerts is only available from 6.1 and up 😞

0 Karma

Explorer

Aww man. Ok thanks for the help.

0 Karma

SplunkTrust
SplunkTrust

What Splunk version are you using?

0 Karma

Explorer

version 5.0.3, build 163460

0 Karma