Reporting

Using $result.fieldname$ for email notification, but it either doesn't show anything or shows the value twice

Jennifer
Path Finder

Hi, Team

I want to use tokens for email and xMater notification. I have one field named Server.

So this is what I write for message for xMatter alerting: Data isn't refreshed in time on $result.Server$

But here's what I received: Data isnt refreshed in time on genesys-pulse-tko-04.hk.hsbc genesys-pulse-tko-04.hk.hsbc

The name of server shows twice on the message. 

Another case is I use token for email notification:

here's what I write on splunk:

The alert condition for $result.Server$ was triggered.

here's what I receive when the alert is triggered:

Jennifer_0-1649389080890.png

Anyone knows the reason of these cases?

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you have the link to the search results with these alerts?

In the first case, does the Server field have a multivalue for the first row of the results?

In the second case, is the Server field empty for the first row of the results?

0 Karma

Jennifer
Path Finder

Here's the search result of the alert:

Jennifer_0-1649400149129.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you expand to show the extracted fields? (Click on the > in the i column)

0 Karma

Jennifer
Path Finder

Jennifer_0-1649400770747.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does it ever work?

In the case of there being no value, what should the value be?

Can you try $result._raw$

0 Karma

Jennifer
Path Finder

Thanks so much:) I've solved the problem. I've changed the search command into:

index="cc_projects"| table Server Data_Refresh
|search Data_Refresh = false

the token is still $result.Server$

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...