Reporting

Include an environmental variable in search results or as part of an alert email subject

taldavita
Explorer

Splunk version 6.5.3

Building a series of alerts in a Development system that include sending an email.

Part of the subject line needs to include the current environment, such as Dev, Test, Prod. My goal is use a variable for the environment value so the code can move between Dev, Test and Prod without modification.

On the search-head in etc/splunk-launch.conf I included:

DVA_ENV=Dev

(restarted the search-head)

splunk envvars shows the environment settings.

However I've not found the syntax to either include environment variable in the search results and or use in an alert email subject.
Is it possible to access the an environment variable? If so, what's the syntax?

Is there a better way to approach this problem?

0 Karma
1 Solution

woodcock
Esteemed Legend

I typically do this by creating a macro; make one called DVA_ENV that does something like this:

| eval DVA_ENV=[|rest/services/authentication/users splunk_server=local | dedup splunk_server | table splunk_server | lookup splunk_server AS server server_to_env_lookup OUTPUT environment AS DVA_ENV | return $DVA_ENV]

The same macro and lookup file/definition can be deployed to all search heads but a different value will be set depending on which search head runs it.

View solution in original post

0 Karma

woodcock
Esteemed Legend

I typically do this by creating a macro; make one called DVA_ENV that does something like this:

| eval DVA_ENV=[|rest/services/authentication/users splunk_server=local | dedup splunk_server | table splunk_server | lookup splunk_server AS server server_to_env_lookup OUTPUT environment AS DVA_ENV | return $DVA_ENV]

The same macro and lookup file/definition can be deployed to all search heads but a different value will be set depending on which search head runs it.

0 Karma

taldavita
Explorer

Good suggestion!

The below statement works when I execute just:

|rest/services/authentication/users splunk_server=local | dedup splunk_server | table splunk_server | lookup splunk_server_info server as splunk_server OUTPUT deployment_environment AS DVA_ENV

the lookup works as expected.

Created a macro called get_deploy_env using

eval DVA_ENV=[ |rest/services/authentication/users splunk_server=local | dedup splunk_server | table splunk_server | lookup splunk_server_info server as splunk_server OUTPUT deployment_environment AS DVA_ENV | return $DVA_ENV]

However when the macro is included in a search the value for DVA_ENV is not returned:

index=myidx | `get_deploy_env splunk_server` | table host splunk_server DVA_ENV
0 Karma

woodcock
Esteemed Legend

Try putting double-quotes around the subsearch. If that doesn't work, then you will have to look at the search log from the job inspector to see what the post-macro search looks like and debug that.

0 Karma

taldavita
Explorer
eval DVA_ENV=[ |rest/services/authentication/users splunk_server=local | dedup splunk_server | table splunk_server | lookup splunk_server_info server as splunk_server OUTPUT deployment_environment | **eval DVA_ENV="\"".deployment_environment."\""** | return $DVA_ENV ]

Found how to make it work.

Thanks!

0 Karma

inventsekar
Super Champion

not sure, but, maybe give this a try..
why using environment variables? maybe, simply on the alert description, you can specify the environment type (dev, prod) and utilize it thru email tokens.

Token                     Description
$description$            Description of the search.

http://docs.splunk.com/Documentation/Splunk/6.1.2/Alert/Setupalertactions#Email_notification

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...