Alerting

Reports Have Changed Since Upgrade to Splunk 6.1

Path Finder

I have just upgraded to Splunk 6.1. I have daily reports that are sent from Splunk. Before the upgrade the report would get sent and the content of the report would be in the header as well as a record count. Now there is a link to the report in Splunk where you can get the details. How can I get back at a bare minimum the total count of rows returned in the report without clicking on the link?

Tags (4)

Splunk Employee
Splunk Employee

If you are talking about email alerts, in Splunk Enterprise 6.1 you can customize the email using tokens. See the Set up alert actions topic in the Alerting Manual for the specifics.

0 Karma

Path Finder

To add Row Count, would savedsearches.conf have this configuration now? Where $job.result.Count$ is new?

[Issue Policy Numbers from States]
action.email = 1
action.email.inline = 1
action.email.reportServerEnabled = 0
action.email.sendresults = 1
action.email.subject = Splunk Alert: ReportName
action.email.to = email addresses
alert.digest_mode = True
more configurations here
vsid = hmm5pnnl
$job.resultCount$

0 Karma