Deployment Architecture
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

set hostname

gcusello
SplunkTrust
SplunkTrust

Hi at all,
I have to create an Heartbeat Alert that contains three fields:

  • TimeStamp,
  • HostName
  • Message My problem is HostName because I have a Search Head Cluster with three SH, so I cannot use a fixed value and I don't know how to set in a search the value of the present SH that is executing the search. Is there a way to do this?

Thank You.
Bye.
Giuseppe

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can use $server.serverName$ in the email alert settings: http://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/EmailNotificationTokens#Server_tokens

In an actual search, you can use | rest splunk_server=local /services/server/info to grab the search head you're running on.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can use $server.serverName$ in the email alert settings: http://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/EmailNotificationTokens#Server_tokens

In an actual search, you can use | rest splunk_server=local /services/server/info to grab the search head you're running on.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Thank you, your rest command answers to my question.
Bye.
Giuseppe

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!