Splunk Log data Enrichment in notifications

[maheswar6523]

I have logs loaded to splunk, I created few alerts to send the error email notifications
till this it is working fine.., only one bottleneck here is they don't want whole error msg
in the email instead then need only meaning ful msg say example:"error_Num:4006 "Duplicate
document created" like this.., before that error_Num:4006 "this is occurred due to the user created
a document with the same name at logs c:/apps/oop"

I created a .csv file and uploaded with 2 perameters:
Error_num, Desc
4006,Duplicate document created
9002,Invalid login

When i user in the serach as |Inputlookup Error_num Outputlookup Desc
this is not working .., pls help in this

[woodcock]

Like this

Your Existing Search For Alerts Here
| lookup YourLookupFileHere.csv Error_num OUTPUT Desc

[renjith_nair]

if the error code and the message are already part of your event, then you could just extract the information and send only required field.

For e.g.

| makeresults |eval string="this is occurred due to the user created a document with the same name at logs c:/apps/oop error_Num:4006 Duplicate document created" 
|rex field=string "^(?:[^:\n]*:){2}\d+\s+(?P<message>.+)" |table message

You shall use the Splunk Field Extractor to extract the messages