Include an environmental variable in search results or as part of an alert email subject

[taldavita]

Splunk version 6.5.3

Building a series of alerts in a Development system that include sending an email.

Part of the subject line needs to include the current environment, such as Dev, Test, Prod. My goal is use a variable for the environment value so the code can move between Dev, Test and Prod without modification.

On the search-head in etc/splunk-launch.conf I included:

DVA_ENV=Dev

(restarted the search-head)

splunk envvars shows the environment settings.

However I've not found the syntax to either include environment variable in the search results and or use in an alert email subject.
Is it possible to access the an environment variable? If so, what's the syntax?

Is there a better way to approach this problem?

[woodcock · Accepted solution]

I typically do this by creating a macro; make one called DVA_ENV that does something like this:

| eval DVA_ENV=[|rest/services/authentication/users splunk_server=local | dedup splunk_server | table splunk_server | lookup splunk_server AS server server_to_env_lookup OUTPUT environment AS DVA_ENV | return $DVA_ENV]

The same macro and lookup file/definition can be deployed to all search heads but a different value will be set depending on which search head runs it.

[taldavita]

Good suggestion!

The below statement works when I execute just:

|rest/services/authentication/users splunk_server=local | dedup splunk_server | table splunk_server | lookup splunk_server_info server as splunk_server OUTPUT deployment_environment AS DVA_ENV

the lookup works as expected.

Created a macro called get_deploy_env using

eval DVA_ENV=[ |rest/services/authentication/users splunk_server=local | dedup splunk_server | table splunk_server | lookup splunk_server_info server as splunk_server OUTPUT deployment_environment AS DVA_ENV | return $DVA_ENV]

However when the macro is included in a search the value for DVA_ENV is not returned:

index=myidx | `get_deploy_env splunk_server` | table host splunk_server DVA_ENV

[woodcock]

Try putting double-quotes around the subsearch. If that doesn't work, then you will have to look at the search log from the job inspector to see what the post-macro search looks like and debug that.

[taldavita]

eval DVA_ENV=[ |rest/services/authentication/users splunk_server=local | dedup splunk_server | table splunk_server | lookup splunk_server_info server as splunk_server OUTPUT deployment_environment | **eval DVA_ENV="\"".deployment_environment."\""** | return $DVA_ENV ]

Found how to make it work.

Thanks!

[inventsekar]

not sure, but, maybe give this a try..
why using environment variables? maybe, simply on the alert description, you can specify the environment type (dev, prod) and utilize it thru email tokens.

Token                     Description
$description$            Description of the search.

http://docs.splunk.com/Documentation/Splunk/6.1.2/Alert/Setupalertactions#Email_notification