Is there a way to view the remainder of the results of an alert?

[danielbb]

The documentation at [Use tokens in email notifications][1] says -

[1]: https://docs.splunk.com/Documentation/Splunk/7.3.0/Alert/EmailNotificationTokens says -

-- You can access field values from the first result row that a search returns. Field availability for tokens depends on what fields are available in search results.

We wonder whether we can view the remainder of the results? (they should be contained in the result.file token)

[woodcock · Accepted solution]

Yes, you can do | loadjob $job.sid$.

[danielbb]

Thank you @woodcock

[danielbb]

@woodcock - is there a way, by any chance, to embed the output of the | loadjob $job.sid$ in the alert itself?

[woodcock]

Not really. The way to do it is to move the thresholding criteria from the alert configurations into the SPL itself like this:

Your Search Stuff Here
| eventstats count(or other aggregation) AS trigger BY host and/or other fields here
| where trigger>YourThresholdHere

So that either you have events (when the trigger condition exists) or not. Then change your alert threshold settings to be Number of Events and Greater than 0 and select the options to include events in your email.

[to4kawa]

If you adjust the search period and alert period for a search query, it will become a reminder.

[gfreitas]

You can choose to send the inline table results of your search, that will show every line of the alert.