Splunk IT Service Intelligence

ITSI Notable Event Email Action

Path Finder

What are the actual $result.fieldname$ tokens that are available in ITSI Notable Events for the Send to Email action. I'm trying to access the notable event title, description, and whatever other fields I can access from the notable event.



Each of the notable events is generated either by a correlation search, multi-kpi alerts, grouping event or alert action. Each one of this carries different $result.fieldnames$.

For the correlation searches and multi-kpi alerts you can check the fields available and their names by executing the search that generated the notable event (Go to Configure -> Correlation Searches and copy the Search string defined).

Also you can check the fields avilable in both the itsi_tracked_alerts and itsi_grouped_alerts indexes. Both of then store the notable events generated by ITSI.

index=itsi_grouped_alerts OR index=itsi_tracked_alerts


0 Karma


Take a look at this search from the _internal index:

index=_internal sendemail sourcetype=itsi_internal_log

And you should see the search that ITSI is running. That will look something like this:

2019-07-09 11:53:02,134 INFO [itsi.controllers.itoa_rest_interface_provider] [notable_event_actions] [execute_action] [9969] Generated search command= search itsi_event_management_group_index itsi_group_id="5a5eb01b-0a1a-45ac-b4c5-15696d3ac9ad" | dedup itsi_group_id | itsi_notable_group_lookup | sendemail "email" subject="$result.itsi_group_description$" message="$result.service_name$ is currently in $result.severity_label$ with a value of $result.severity_value$ at $result.actual_time$

Execute the generated search command and that will show you the fields that are available.

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...