Alerting

Reports Have Changed Since Upgrade to Splunk 6.1

ezajac
Path Finder

I have just upgraded to Splunk 6.1. I have daily reports that are sent from Splunk. Before the upgrade the report would get sent and the content of the report would be in the header as well as a record count. Now there is a link to the report in Splunk where you can get the details. How can I get back at a bare minimum the total count of rows returned in the report without clicking on the link?

Tags (4)

ChrisG
Splunk Employee
Splunk Employee

If you are talking about email alerts, in Splunk Enterprise 6.1 you can customize the email using tokens. See the Set up alert actions topic in the Alerting Manual for the specifics.

0 Karma

ezajac
Path Finder

To add Row Count, would savedsearches.conf have this configuration now? Where $job.result.Count$ is new?

[Issue Policy Numbers from States]
action.email = 1
action.email.inline = 1
action.email.reportServerEnabled = 0
action.email.sendresults = 1
action.email.subject = Splunk Alert: ReportName
action.email.to = email addresses
alert.digest_mode = True
more configurations here
vsid = hmm5pnnl
$job.resultCount$

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...