set hostname

[gcusello]

Hi at all,
I have to create an Heartbeat Alert that contains three fields:

• TimeStamp,
• HostName
• Message My problem is HostName because I have a Search Head Cluster with three SH, so I cannot use a fixed value and I don't know how to set in a search the value of the present SH that is executing the search. Is there a way to do this?

Thank You.
Bye.
Giuseppe

[martin_mueller · Accepted solution]

You can use $server.serverName$ in the email alert settings: http://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/EmailNotificationTokens#Server_tokens

In an actual search, you can use | rest splunk_server=local /services/server/info to grab the search head you're running on.

[gcusello]

Thank you, your rest command answers to my question.
Bye.
Giuseppe