Reporting

Using $result.fieldname$ for email notification, but it either doesn't show anything or shows the value twice

Jennifer
Path Finder

Hi, Team

I want to use tokens for email and xMater notification. I have one field named Server.

So this is what I write for message for xMatter alerting: Data isn't refreshed in time on $result.Server$

But here's what I received: Data isnt refreshed in time on genesys-pulse-tko-04.hk.hsbc genesys-pulse-tko-04.hk.hsbc

The name of server shows twice on the message. 

Another case is I use token for email notification:

here's what I write on splunk:

The alert condition for $result.Server$ was triggered.

here's what I receive when the alert is triggered:

Jennifer_0-1649389080890.png

Anyone knows the reason of these cases?

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you have the link to the search results with these alerts?

In the first case, does the Server field have a multivalue for the first row of the results?

In the second case, is the Server field empty for the first row of the results?

0 Karma

Jennifer
Path Finder

Here's the search result of the alert:

Jennifer_0-1649400149129.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you expand to show the extracted fields? (Click on the > in the i column)

0 Karma

Jennifer
Path Finder

Jennifer_0-1649400770747.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does it ever work?

In the case of there being no value, what should the value be?

Can you try $result._raw$

0 Karma

Jennifer
Path Finder

Thanks so much:) I've solved the problem. I've changed the search command into:

index="cc_projects"| table Server Data_Refresh
|search Data_Refresh = false

the token is still $result.Server$

Tags (1)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...