Deployment Architecture

Multiple fields for email notification

abhishekgandhe
Explorer

Following is my JSON data: -

{
"message": [
{
"raw": "04/12/18 14:03:56 [28] ERROR :: TenantId = model-cps-czooarea05nap01 :: JobId = 383d529e-4d7a-465d-8823-798d6e661788 :: CalcType = Process Monitor :: UniSimInvokerServices.HttpHelper : Complete Exception Details: System.Threading.Tasks.TaskCanceledException: A task was canceled.\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Net.Http.HttpClient.d_58.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()\r\n at UniSimInvokerServices.HttpHelper.d3.MoveNext() in C:\Users\E542204\Source\Repos\cps-unisim-taskexecutor\Honeywell.PMT.UOP.CPS.UniSimInvoker\HttpHelper.cs:line 66",
"severityLevel": "Error",
"className": "UniSimInvokerServices.HttpHelper+d
3",
"methodName": "MoveNext",
"lineNumber": 115,
"domain": "Honeywell.PMT.UOP.CPS.UniSimTaskService.exe",
"loggerName": "UTELogger",
"threadName": "28"
}
],
"internal": {
"data": {
"id": "7f55dcd3-f7cd-11e8-b587-fb20626c7e32",
"documentVersion": "1.61"
}
},
"context": {
"data": {
"eventTime": "2018-12-04T14:03:56.7939778Z",
"isSynthetic": false,
"samplingRate": 100
},
"cloud": {},
"device": {
"type": "PC",
"roleInstance": "usd-qa-wk1-eus",
"screenResolution": {}
},
"session": {
"isFirst": false
},
"operation": {},
"location": {
"clientip": "0.0.0.0",
"continent": "North America",
"country": "United States",
"province": "Virginia",
"city": "Boydton"
},
"custom": {
"dimensions": [
{
"TenantId": "model-cps-czooarea05nap01"
},
{
"LoggerName": "UTELogger"
},
{
"CalcType": "Process Monitor"
},
{
"JobId": "383d529e-4d7a-465d-8823-798d6e661788"
},
{
"MethodName": "MoveNext"
},
{
"LineNumber": "115"
},
{
"Domain": "Honeywell.PMT.UOP.CPS.UniSimTaskService.exe"
},
{
"ThreadName": "28"
},
{
"ClassName": "UniSimInvokerServices.HttpHelper+d
_3"
},
{
"FileName": "C:\Users\E542204\Source\Repos\cps-unisim-taskexecutor\Honeywell.PMT.UOP.CPS.UniSimInvoker\HttpHelper.cs"
}
]
}
}
}

I want to use the fields - TenantId, CalcType, ClassName, eventTime - in the email notification.
How to use these fields in email alert? What will be search string for such scenario?

Tags (1)
0 Karma

dkeck
Influencer

Hi,

it would be easier to help with more information. Do you already have those fileds extracted in your index?

What do you want to alert on, when a certain values shows up in those fields etc.?

Kind Regards

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

It's plausible that curly braces don't work in token names - if that's the case do rename the fields at the end of your search and use the cleaned names in your email tokens.

0 Karma

abhishekgandhe
Explorer

This is the search string: -

index=cpsprod sourcetype="mscs:storage:blob:cps-prod-unisim-taskexecutor" "message{}.severityLevel"=Error "context.data.eventTime"="" "context.custom.dimensions{}.CalcType"="" "context.custom.dimensions{}.TenantId"="*"

I am getting eventTime using $result.context.data.eventTime$.
Not getting values for $result.context.custom.dimensions{}.TenantId$ and $result.context.custom.dimensions{}.CalcType$

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!