Deployment Architecture

Multiple fields for email notification

abhishekgandhe
Explorer

Following is my JSON data: -

{
"message": [
{
"raw": "04/12/18 14:03:56 [28] ERROR :: TenantId = model-cps-czooarea05nap01 :: JobId = 383d529e-4d7a-465d-8823-798d6e661788 :: CalcType = Process Monitor :: UniSimInvokerServices.HttpHelper : Complete Exception Details: System.Threading.Tasks.TaskCanceledException: A task was canceled.\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Net.Http.HttpClient.d_58.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()\r\n at UniSimInvokerServices.HttpHelper.d3.MoveNext() in C:\Users\E542204\Source\Repos\cps-unisim-taskexecutor\Honeywell.PMT.UOP.CPS.UniSimInvoker\HttpHelper.cs:line 66",
"severityLevel": "Error",
"className": "UniSimInvokerServices.HttpHelper+d
3",
"methodName": "MoveNext",
"lineNumber": 115,
"domain": "Honeywell.PMT.UOP.CPS.UniSimTaskService.exe",
"loggerName": "UTELogger",
"threadName": "28"
}
],
"internal": {
"data": {
"id": "7f55dcd3-f7cd-11e8-b587-fb20626c7e32",
"documentVersion": "1.61"
}
},
"context": {
"data": {
"eventTime": "2018-12-04T14:03:56.7939778Z",
"isSynthetic": false,
"samplingRate": 100
},
"cloud": {},
"device": {
"type": "PC",
"roleInstance": "usd-qa-wk1-eus",
"screenResolution": {}
},
"session": {
"isFirst": false
},
"operation": {},
"location": {
"clientip": "0.0.0.0",
"continent": "North America",
"country": "United States",
"province": "Virginia",
"city": "Boydton"
},
"custom": {
"dimensions": [
{
"TenantId": "model-cps-czooarea05nap01"
},
{
"LoggerName": "UTELogger"
},
{
"CalcType": "Process Monitor"
},
{
"JobId": "383d529e-4d7a-465d-8823-798d6e661788"
},
{
"MethodName": "MoveNext"
},
{
"LineNumber": "115"
},
{
"Domain": "Honeywell.PMT.UOP.CPS.UniSimTaskService.exe"
},
{
"ThreadName": "28"
},
{
"ClassName": "UniSimInvokerServices.HttpHelper+d
_3"
},
{
"FileName": "C:\Users\E542204\Source\Repos\cps-unisim-taskexecutor\Honeywell.PMT.UOP.CPS.UniSimInvoker\HttpHelper.cs"
}
]
}
}
}

I want to use the fields - TenantId, CalcType, ClassName, eventTime - in the email notification.
How to use these fields in email alert? What will be search string for such scenario?

Tags (1)
0 Karma

dkeck
Influencer

Hi,

it would be easier to help with more information. Do you already have those fileds extracted in your index?

What do you want to alert on, when a certain values shows up in those fields etc.?

Kind Regards

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

It's plausible that curly braces don't work in token names - if that's the case do rename the fields at the end of your search and use the cleaned names in your email tokens.

0 Karma

abhishekgandhe
Explorer

This is the search string: -

index=cpsprod sourcetype="mscs:storage:blob:cps-prod-unisim-taskexecutor" "message{}.severityLevel"=Error "context.data.eventTime"="" "context.custom.dimensions{}.CalcType"="" "context.custom.dimensions{}.TenantId"="*"

I am getting eventTime using $result.context.data.eventTime$.
Not getting values for $result.context.custom.dimensions{}.TenantId$ and $result.context.custom.dimensions{}.CalcType$

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...