Dashboards & Visualizations

Alert trigger condition token

ryhluc01
Communicator

Is there a token for trigger conditions? The trigger condition option within the alert only tells you the type (i.e numbered or custom) of condition but not the content of the condition.

0 Karma
1 Solution

ryhluc01
Communicator

I was not able to find a token for this purpose. I ended up just manually typing in my condition instead

View solution in original post

0 Karma

ryhluc01
Communicator

I was not able to find a token for this purpose. I ended up just manually typing in my condition instead

0 Karma

niketn
Legend

@ryhluc01 please elaborate your question for the need of token for the community to assist you better. Can Custom trigger condition help you in any way?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ryhluc01
Communicator

Thank you, I was essentially looking for a quick way to insert the content for my triggered condition directly into the email without having to manually type it out. I was hoping there was a token to use instead.

We have tokens for all sorts of things but I have not found one that will grab the content of the alert trigger.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...