Alerting
Highlighted

Include hostname in alert email subject

Explorer

I'm looking for a way to include the hostname in an alert email subject. Our pager system ignores multiple alerts with same subject so it is possible to miss alerts from multiple hosts with same issue.

Thanks for reading.

Tags (3)
Highlighted

Re: Include hostname in alert email subject

SplunkTrust
SplunkTrust
Highlighted

Re: Include hostname in alert email subject

SplunkTrust
SplunkTrust

What Splunk version are you using?

0 Karma
Highlighted

Re: Include hostname in alert email subject

Explorer

version 5.0.3, build 163460

0 Karma
Highlighted

Re: Include hostname in alert email subject

SplunkTrust
SplunkTrust

Using search results as tokens in Email alerts is only available from 6.1 and up 😞

0 Karma
Highlighted

Re: Include hostname in alert email subject

Explorer

Aww man. Ok thanks for the help.

0 Karma
Highlighted

Re: Include hostname in alert email subject

SplunkTrust
SplunkTrust

Upgrading is fairly painless...

0 Karma
Highlighted

Re: Include hostname in alert email subject

Path Finder

Put the token $result.host$ in the subject section of the alert configuration.

See http://docs.splunk.com/Documentation/Splunk/6.2.3/Alert/Setupalertactions for more details.

Highlighted

Re: Include hostname in alert email subject

Explorer

Thanks for the quick reply. I've tested and this solution does not work. I've tested with token "$result.host$" and "$result.src_host$".

My saved search is as follows:
Search
tag::host="atg" tag::host="prod1" source=*/server.log TESTING--SRUFF
Email subject
Splunk Alert: $name$ $result.host$

Latest alert email subject line has "Splunk Alert: <saved search name>" but does not include the hostname of from the server who's log contained the search text. I was expecting to see "Splunk Alert: <saved search name> <server name>".

Thanks.

0 Karma
Highlighted

Re: Include hostname in alert email subject

Path Finder

Just for sanity's sake, see if that token works for you in the alert body.

$result.host$ means insert from the results, the value of the field named host. There are some oddities for some cases in that token, but source and host should just work.

0 Karma