I have a search
"%UC_CALLMANAGER-6-DeviceUnregistered" "DeviceType=90" OR "DeviceType=73"
Which correctly matches the below entry and I have an alert so send an email notification. I would like to pass a string from the syslog text (DeviceName=JK-Test) in the email message but can’t seem to get it pass. When I expand the syslog in search it says DeviceName is JK-Test. In my email message I have tried:
email text:
$Result.DeviceName$ test line 1
"$event.DeviceName$" test line 2
$DeviceName$ test line 3
$result.devicename$ test line 4
Is there a format to where I can pass that info?
search result:
Feb 25 16:17:26 myserver.local Feb 25 2020 22:17:26.527 UTC : %UC_CALLMANAGER-6-DeviceUnregistered: %[DeviceName=JK-Test][IPAddress=1.1.1.1][Protocol=RouteList][DeviceType=90][Description=Test Hunt Group][Reason=8][IPAddrAttributes=0][AppID=Cisco CallManager][ClusterID=StandAloneCluster][NodeID=myserver]: Device unregistered
