Splunk AppDynamics

How to include current, baseline, threshold values in HTML Body event message in Email Template

CommunityUser
Splunk Employee
Splunk Employee

Hello,

We have to change the email template body message to below, we are able to print Time Stamp, Alert Type, Event message but we are unable to get Current, Baseline and Threshold value to print separatly.

--------------------------------------------------------------------------------------------------------------

Used below for Time Stamp, Alert Type and Message

Time Stamp: ${action.triggerTime}:

Alert Type: ${latestEvent.healthRule.name}
For Application ${latestEvent.application.name}  Current ${latestEvent.healthRule.name} has breached the baseline value for last 10/20 mins.

Current Value - <$xxxx>

Baseline Value - <$xxxxx>

Threshold (3 Std Deviations) - <$xxxx>

--------------------------------------------------------------------------------------------------------------

Output:

Time Stamp - Tue Jul 24 12:42:10 IST 2018:

Alert Type - Average Response Time

For Application ABC_XYZ_Prod  Current Average Response Time 7754.0 has breached the baseline value for last 10/20 mins.

 

Current Value - 7754.0 <Unable to print>

Baseline Value - 337.0 <Unable to print>

Threshold (3 Std Deviations) - 517.4 <Unable to print>

--------------------------------------------------------------------------------------------------------------

Please suggest

Thanks,

kalyan

Labels (3)

SERDAR_KULHANCI
Engager

+1

0 Karma

Rugved_Sarode
Splunk Employee
Splunk Employee

Hello,

There is already an enhancement to further expose values under eventMessage variables such as condition, violating values etc.

Currently, eventMessage is the only option which is a long string.

You can use split / regex on a string as in the usual java context.

Example-

#set ($summary = ${latestEvent.summaryMessage})
#set ($job = $summary.split(" "))
summary: $summary
Job: $job[2]
Job2: $job.get(2)

This is the sample eventMessage-

AppDynamics has detected a problem with Node nodejs-api-services--9.
Memory utilization is too high started violating and is now critical.
All of the following conditions were found to be violating
For Node nodejs-api-services--9:
1) Hardware Resources|Memory|Used % Condition
Used %'s value 93.00 was greater than the threshold 90.00 for the last 30 minutes

where we have set condition name as "Hardware Resources|Memory|Used %"

Abhimanyu_Sharm
New Member

@Rugved.Sarode Unfortunately this is not working for me.

Sample summary message- AppDynamics has detected a problem with Node node1.
Memory utilization is too high started violating and is now warning.

After splitting the summary message I am getting "detected" with both $job.get(2) and $job[2].

I am not sure how you were able to get

Used %'s value 93.00 was greater than the threshold 90.00 for the last 30 minutes

from summary message you provided.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...