Dashboards & Visualizations

Pass string/token to email alert text

New Member

I have a search
"%UC_CALLMANAGER-6-DeviceUnregistered" "DeviceType=90" OR "DeviceType=73"

Which correctly matches the below entry and I have an alert so send an email notification. I would like to pass a string from the syslog text (DeviceName=JK-Test) in the email message but can’t seem to get it pass. When I expand the syslog in search it says DeviceName is JK-Test. In my email message I have tried:

email text:
$Result.DeviceName$ test line 1
"$event.DeviceName$" test line 2
$DeviceName$ test line 3
$result.devicename$ test line 4

Is there a format to where I can pass that info?

search result:
Feb 25 16:17:26 myserver.local Feb 25 2020 22:17:26.527 UTC : %UC_CALLMANAGER-6-DeviceUnregistered: %[DeviceName=JK-Test][IPAddress=][Protocol=RouteList][DeviceType=90][Description=Test Hunt Group][Reason=8][IPAddrAttributes=0][AppID=Cisco CallManager][ClusterID=StandAloneCluster][NodeID=myserver]: Device unregistered

0 Karma

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!