All Apps and Add-ons

How do I set up a Splunk alert email subject as token?

dataengineer
Observer

I have written a splunk query to extract timeout logs for my functions and am creating a scheduled alert. I have created an email alert action. For the email subject, I want the function name to appear in the subject line. I have tried using $result.fieldname$ and $job.label$ in the subject but it does not give the desired output.

For example, if my function test_func fails, I want the subject to look like 'Job Failure for test_func'. For this, I am coding the Subject field in the alert as 'Job Failure for $result.function_name$'. But, it just sends an email alert with subject as 'Job Failure for '. I have also tried using other tokens like '$job.label$', but I couldn't get the desired output.

Can somebody please pitch in?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

$result.fieldname$ should work but it only works for the first row of your results. Please check that your field has a value in the first row.

0 Karma

dataengineer
Observer

Do you mean the values in the first row of the output events? Or do you mean the value in the first row of the inline table? Both of those have values in the first row. And I tried testing with $result.fieldname$ but got an empty response for that.

What other way can I get the function name in the email subject?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share your search SPL in a code block </>?

0 Karma

dataengineer
Observer

This is the spunk search:

index=xyz
"Timing out job_id"
"fields.kubernetes.namespace_name"="xyz"
test_function OR test_function2

 

This is the email subject: Job Failure: $result.fields.kubernetes.pod_name$

This is the email message I am using:  There were $job.resultCount$ errors reported on $trigger_date$. The $job.label$ run instance failed.

 

$result.fields.kubernetes.pod_name$ does not give me the pod_name (which is like my function name)

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try renaming it so that it doesn't have dots in

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...