Dear,
i was looking in manual and search over this board, and cannot find exactly how to put for example in alert trigger, sending email with subject which contain value from search .
Situation is this:
1. backup server send email with subject and message of hostname of server which are failed.
2. Splunk read that email with imap, triger alert on specific word in email and send email.
All that work fine, but those email from splunk i cannot use if i don`t have hostname in subject/message of email..
I am getting empty emails...
tried couple options, but unsuccessful ..
can i get some directive how proper to setup this?
i tried $result.failed$ (because subject/message from backup server contain only "failed hostname.of.server") and nothing...
