Alerting

Is there a way to view the remainder of the results of an alert?

Motivator

The documentation at [Use tokens in email notifications][1] says -

[1]: https://docs.splunk.com/Documentation/Splunk/7.3.0/Alert/EmailNotificationTokens says -

-- You can access field values from the first result row that a search returns. Field availability for tokens depends on what fields are available in search results.

We wonder whether we can view the remainder of the results? (they should be contained in the result.file token)

Tags (1)
0 Karma
1 Solution

Esteemed Legend

Yes, you can do | loadjob $job.sid$.

View solution in original post

Esteemed Legend

Yes, you can do | loadjob $job.sid$.

View solution in original post

Motivator

Thank you @woodcock

Motivator

@woodcock - is there a way, by any chance, to embed the output of the | loadjob $job.sid$ in the alert itself?

0 Karma

Esteemed Legend

Not really. The way to do it is to move the thresholding criteria from the alert configurations into the SPL itself like this:

Your Search Stuff Here
| eventstats count(or other aggregation) AS trigger BY host and/or other fields here
| where trigger>YourThresholdHere

So that either you have events (when the trigger condition exists) or not. Then change your alert threshold settings to be Number of Events and Greater than 0 and select the options to include events in your email.

Ultra Champion

If you adjust the search period and alert period for a search query, it will become a reminder.

0 Karma

Builder

You can choose to send the inline table results of your search, that will show every line of the alert.