Reporting

Using $result.fieldname$ for email notification, but it either doesn't show anything or shows the value twice

Jennifer
Path Finder

Hi, Team

I want to use tokens for email and xMater notification. I have one field named Server.

So this is what I write for message for xMatter alerting: Data isn't refreshed in time on $result.Server$

But here's what I received: Data isnt refreshed in time on genesys-pulse-tko-04.hk.hsbc genesys-pulse-tko-04.hk.hsbc

The name of server shows twice on the message. 

Another case is I use token for email notification:

here's what I write on splunk:

The alert condition for $result.Server$ was triggered.

here's what I receive when the alert is triggered:

Jennifer_0-1649389080890.png

Anyone knows the reason of these cases?

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you have the link to the search results with these alerts?

In the first case, does the Server field have a multivalue for the first row of the results?

In the second case, is the Server field empty for the first row of the results?

0 Karma

Jennifer
Path Finder

Here's the search result of the alert:

Jennifer_0-1649400149129.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you expand to show the extracted fields? (Click on the > in the i column)

0 Karma

Jennifer
Path Finder

Jennifer_0-1649400770747.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does it ever work?

In the case of there being no value, what should the value be?

Can you try $result._raw$

0 Karma

Jennifer
Path Finder

Thanks so much:) I've solved the problem. I've changed the search command into:

index="cc_projects"| table Server Data_Refresh
|search Data_Refresh = false

the token is still $result.Server$

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...