Dashboards & Visualizations

Alert trigger condition token

ryhluc01
Communicator

Is there a token for trigger conditions? The trigger condition option within the alert only tells you the type (i.e numbered or custom) of condition but not the content of the condition.

0 Karma
1 Solution

ryhluc01
Communicator

I was not able to find a token for this purpose. I ended up just manually typing in my condition instead

View solution in original post

0 Karma

ryhluc01
Communicator

I was not able to find a token for this purpose. I ended up just manually typing in my condition instead

0 Karma

niketn
Legend

@ryhluc01 please elaborate your question for the need of token for the community to assist you better. Can Custom trigger condition help you in any way?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ryhluc01
Communicator

Thank you, I was essentially looking for a quick way to insert the content for my triggered condition directly into the email without having to manually type it out. I was hoping there was a token to use instead.

We have tokens for all sorts of things but I have not found one that will grab the content of the alert trigger.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...