Reporting

Splunk Scheduled PDF - Use token on mail subject

nuaraujo
Path Finder

Hello everyone

I have a scheduled PDF delivery mail, where I want to manipulate the mail subject, using a mail token. Basically, I want to add the word SUCCESS or ERROR, to the mail subject.

To achieve this, on my dashboard, I am using a global search, where I am creating a token, using the following code:

<search id="get_status_token">
    <query>my_search_here
| eval fstatus=if(AAA==BBB AND CCC==DDD  , "SUCCESS","ERROR")
| fields fstatus</query>
    <earliest>-1d@d</earliest>
    <latest>@d</latest>
    <sampleRatio>1</sampleRatio>
    <done>
      <set token="fstatus">$result.fstatus$</set>
    </done>
  </search>

On the EDIT PDF SCHEDULE menu, I adding the following code as Subject

TEST $fstatus$

but the email does never display the value of the token in the subject.

Can someone help me find what am I missing?

NOTE: I am using the token in the email subject and not in the PDF.

Thanks in advance

Tags (1)
0 Karma
1 Solution

masonmorales
Influencer

Instead of setting a token in the XML of the report, try using a token with the sendemail command.
i.e.

<query>my_search_here
 | eval fstatus=if(AAA==BBB AND CCC==DDD  , "SUCCESS","ERROR")
 | fields fstatus
 | sendemail to=someone@somewhere.net sendpdf=t subject=$result.fstatus$</query> 

View solution in original post

0 Karma

masonmorales
Influencer

Instead of setting a token in the XML of the report, try using a token with the sendemail command.
i.e.

<query>my_search_here
 | eval fstatus=if(AAA==BBB AND CCC==DDD  , "SUCCESS","ERROR")
 | fields fstatus
 | sendemail to=someone@somewhere.net sendpdf=t subject=$result.fstatus$</query> 
0 Karma

nuaraujo
Path Finder

Thanks @masonmorales for the quick reply, but since in this dashboard I have 3 different searches, this would require at least 3 mails.

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...