Reporting

Using $result.fieldname$ for email notification, but it either doesn't show anything or shows the value twice

Jennifer
Path Finder

Hi, Team

I want to use tokens for email and xMater notification. I have one field named Server.

So this is what I write for message for xMatter alerting: Data isn't refreshed in time on $result.Server$

But here's what I received: Data isnt refreshed in time on genesys-pulse-tko-04.hk.hsbc genesys-pulse-tko-04.hk.hsbc

The name of server shows twice on the message. 

Another case is I use token for email notification:

here's what I write on splunk:

The alert condition for $result.Server$ was triggered.

here's what I receive when the alert is triggered:

Jennifer_0-1649389080890.png

Anyone knows the reason of these cases?

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you have the link to the search results with these alerts?

In the first case, does the Server field have a multivalue for the first row of the results?

In the second case, is the Server field empty for the first row of the results?

0 Karma

Jennifer
Path Finder

Here's the search result of the alert:

Jennifer_0-1649400149129.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you expand to show the extracted fields? (Click on the > in the i column)

0 Karma

Jennifer
Path Finder

Jennifer_0-1649400770747.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does it ever work?

In the case of there being no value, what should the value be?

Can you try $result._raw$

0 Karma

Jennifer
Path Finder

Thanks so much:) I've solved the problem. I've changed the search command into:

index="cc_projects"| table Server Data_Refresh
|search Data_Refresh = false

the token is still $result.Server$

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...