Splunk Search

How to access searchmatch count in eMail notifications

kodaganti
New Member

I have the below working SPLUNK query which is being used to print the timechart. I would like to trigger an email alert on daily basis. I would like to use the same query for email alert on daily basis.

Problem : How can I access the count of each searchmatch in email notification?

I am trying to access the counts like below in Splunk alert:

'$name$' 

Status Value  :  Count

Approved : $result.string.Approved$
Declined   : $result.string.Decline$
Pending    : $result.string.Pending$
Review      : $result.string.Review$
Null            :$result.string.Null_Status$

ALL            :  $result.All$ (Should be sum of all above statues)

But it is not working.

Here is the Query:

index=dotcom sourcetype=dotcom_cc   "and applicationStatus value : *" OR "and applicationStatus value : D" OR "and applicationStatus value : R"  OR "and applicationStatus value : A" OR "and applicationStatus value : P" OR "and applicationStatus value : null"  | eval string=case(searchmatch("and applicationStatus value : D"), "Decline",  searchmatch("and applicationStatus value : R"), "Review",  searchmatch("and applicationStatus value : A"), "Approved",  searchmatch("and applicationStatus value : P"), "Pending",  searchmatch("and applicationStatus value : null"), "Null_Status") | timechart count by string
0 Karma

woodcock
Esteemed Legend

First, add this to your search:

| eval All = "Decline" + "Review" + "Approved" + "Pending" + "Null_Status"

Then try this for your email:

'$name$'

Status Value:  Count
Approved:      $result.Approved$
Declined:      $result.Decline$
Pending:       $result.Pending$
Review:        $result.Review$
Null:          $result.Null_Status$

ALL:           $result.All$
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...