Other Usage

What variables can you use in email subject?

BobM
Builder

In the docs, it says

You can enter a subject header for the email (by default it is set to be Splunk Alert: $name$, where $name$ is replaced by the saved search name)

Is there a list of other variables we can use in this and are they configurable? IE can I use part of the result in the subject.

Also can we use these variables elsewhere? ie. Search for a user that has used the SU command and email them asking for a reason why.

Tags (3)
1 Solution

rossikwan
Path Finder

Except the $name$, is there any useful example in that xml?

I found some of it & listed below (not tested), is it fine to add $xxx$ in the email subject?

  • $search$
  • $description$
  • $timerange$
  • $alert.severity$

View solution in original post

bmunson_splunk
Splunk Employee
Splunk Employee

Splunk have listened.

Version 6.1 of splunk now has TO: CC: & BCC:, Priority, Subject and a multi line Message. You also have the option of including the search string or not as well as the results. And they have listed the tokens (like $alert.severity$) that can be used.

And this can be triggered from the search string with the sendmail command.

See http://docs.splunk.com/Documentation/Splunk/6.1.2/Alert/Setupalertactions#Email_notification for details. In here are the tokens

$action.email.hostname$     Hostname of the email server.
$action.email.priority$     Priority of the search.
$app$   Name of the app containing the search.
$cron_schedule$     Cron schedule for the app.
$description$   Description of the search.
$name$  Name of the search.
$next_scheduled_time$   The next time the search runs.
$owner$     Owner of the search.
$results_link$  (Alert actions and scheduled reports only) Link to the search results.
$search$    The actual search.
$trigger_date$  (Alert actions only) The date that triggers the alert.
$trigger_time$  (Alert actions only) The scheduled time the alert runs.
$type$  Indicates if the search is from an alert, report, view, or the search command.
$view_link$     Link to view the saved report.
$alert.severity$    Severity level of the alert.
$alert.expires$     Time the alert expires. 

otheus
Explorer

Splunk doc team: why can't you permalink your docs? 

 

Current (2023/q1) docs: https://docs.splunk.com/Documentation/Splunk/9.0.4/Alert/EmailNotificationTokens

0 Karma

chanst2
Path Finder

$trigger_time$ can only show the epoch time, $trigger_timeHMS$ can show a readable time but only in 12-H format and it's without the AM/PM indicator.

ssContent['trigger_timeHMS'] = time.strftime("%I:%M:%S", triggerSeconds)

the only way to show a proper time value is to override the sendemail.py in $SPLUNK_HOME/etc/apps/search/bin/, either by directly modifying it (not recommended) or put the updated version in another app or etc/system/

Python time format directives can be found here:
https://docs.python.org/2/library/time.html

I believe any key you can find in the ssContent array of that python script can be used in the email subject or content

0 Karma

rossikwan
Path Finder

Except the $name$, is there any useful example in that xml?

I found some of it & listed below (not tested), is it fine to add $xxx$ in the email subject?

  • $search$
  • $description$
  • $timerange$
  • $alert.severity$

johnebgood
Path Finder

It is now possible to use fields from the results of a search, here is an example subject for an e-mail alert:
Splunk Alert: $result.host$ has failed $result.failure_count$ times in $result.time_range$

richprescott
Path Finder

You can find the list of variables available in the following file:

$SPLUNK_HOME$\etc\apps\search\default\data\ui\manager\saved_searches.xml

They are designated in the XML as element names:

element name="name" label="Search name"

$name$ comes from the the element's name property

BobM
Builder

You can use $description$ but I have not found anything else.

Ant1D
Motivator

Has there been any developments for this since this question was asked?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...