Splunk AppDynamics

How to include current, baseline, threshold values in HTML Body event message in Email Template

CommunityUser
Splunk Employee
Splunk Employee

Hello,

We have to change the email template body message to below, we are able to print Time Stamp, Alert Type, Event message but we are unable to get Current, Baseline and Threshold value to print separatly.

--------------------------------------------------------------------------------------------------------------

Used below for Time Stamp, Alert Type and Message

Time Stamp: ${action.triggerTime}:

Alert Type: ${latestEvent.healthRule.name}
For Application ${latestEvent.application.name}  Current ${latestEvent.healthRule.name} has breached the baseline value for last 10/20 mins.

Current Value - <$xxxx>

Baseline Value - <$xxxxx>

Threshold (3 Std Deviations) - <$xxxx>

--------------------------------------------------------------------------------------------------------------

Output:

Time Stamp - Tue Jul 24 12:42:10 IST 2018:

Alert Type - Average Response Time

For Application ABC_XYZ_Prod  Current Average Response Time 7754.0 has breached the baseline value for last 10/20 mins.

 

Current Value - 7754.0 <Unable to print>

Baseline Value - 337.0 <Unable to print>

Threshold (3 Std Deviations) - 517.4 <Unable to print>

--------------------------------------------------------------------------------------------------------------

Please suggest

Thanks,

kalyan

Labels (3)

SERDAR_KULHANCI
Engager

+1

0 Karma

Rugved_Sarode
Explorer

Hello,

There is already an enhancement to further expose values under eventMessage variables such as condition, violating values etc.

Currently, eventMessage is the only option which is a long string.

You can use split / regex on a string as in the usual java context.

Example-

#set ($summary = ${latestEvent.summaryMessage})
#set ($job = $summary.split(" "))
summary: $summary
Job: $job[2]
Job2: $job.get(2)

This is the sample eventMessage-

AppDynamics has detected a problem with Node nodejs-api-services--9.
Memory utilization is too high started violating and is now critical.
All of the following conditions were found to be violating
For Node nodejs-api-services--9:
1) Hardware Resources|Memory|Used % Condition
Used %'s value 93.00 was greater than the threshold 90.00 for the last 30 minutes

where we have set condition name as "Hardware Resources|Memory|Used %"

Abhimanyu_Sharm
New Member

@Rugved.Sarode Unfortunately this is not working for me.

Sample summary message- AppDynamics has detected a problem with Node node1.
Memory utilization is too high started violating and is now warning.

After splitting the summary message I am getting "detected" with both $job.get(2) and $job[2].

I am not sure how you were able to get

Used %'s value 93.00 was greater than the threshold 90.00 for the last 30 minutes

from summary message you provided.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...