Hi,
I have extracted a new filed "proc_name" from source and added it to table command of existing query and i am generating an email alert which is not showing new filed "proc_name" value in email.
host=XXX index=YYY sourcetype=app_logs rc time_taken="*"
| search RC>=8
| table client_ip, proc_name, proc_id, RC, Message
client_ip |
proc_name |
proc_id |
RC |
Message |
MsgIDLCPS0. | 5030 | 7 | Process 'UPROC' #50930 - RC=7MsgIDLCPS0. |
How have you extracted the proc_name field, i.e. what configuration have you used and where is it deployed?
I have extracted the field using filed extractor and named it "proc_name" and directly used it in table command. Tried to populate it in email using $result.proc_name$