Splunk IT Service Intelligence

ITSI Notable Event Email Action

Justinboucher0
Path Finder

What are the actual $result.fieldname$ tokens that are available in ITSI Notable Events for the Send to Email action. I'm trying to access the notable event title, description, and whatever other fields I can access from the notable event.

jaime_ramirez
Communicator

Hi

Each of the notable events is generated either by a correlation search, multi-kpi alerts, grouping event or alert action. Each one of this carries different $result.fieldnames$.

For the correlation searches and multi-kpi alerts you can check the fields available and their names by executing the search that generated the notable event (Go to Configure -> Correlation Searches and copy the Search string defined).

Also you can check the fields avilable in both the itsi_tracked_alerts and itsi_grouped_alerts indexes. Both of then store the notable events generated by ITSI.

index=itsi_grouped_alerts OR index=itsi_tracked_alerts

Cheers!!!

0 Karma

roman3ro
Engager

Take a look at this search from the _internal index:

index=_internal sendemail sourcetype=itsi_internal_log

And you should see the search that ITSI is running. That will look something like this:

2019-07-09 11:53:02,134 INFO [itsi.controllers.itoa_rest_interface_provider] [notable_event_actions] [execute_action] [9969] Generated search command= search itsi_event_management_group_index itsi_group_id="5a5eb01b-0a1a-45ac-b4c5-15696d3ac9ad" | dedup itsi_group_id | itsi_notable_group_lookup | sendemail "email" subject="$result.itsi_group_description$" message="$result.service_name$ is currently in $result.severity_label$ with a value of $result.severity_value$ at $result.actual_time$

Execute the generated search command and that will show you the fields that are available.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...