Splunk IT Service Intelligence

ITSI Notable Event Email Action

Path Finder

What are the actual $result.fieldname$ tokens that are available in ITSI Notable Events for the Send to Email action. I'm trying to access the notable event title, description, and whatever other fields I can access from the notable event.


Re: ITSI Notable Event Email Action


Take a look at this search from the _internal index:

index=_internal sendemail sourcetype=itsi_internal_log

And you should see the search that ITSI is running. That will look something like this:

2019-07-09 11:53:02,134 INFO [itsi.controllers.itoa_rest_interface_provider] [notable_event_actions] [execute_action] [9969] Generated search command= search itsi_event_management_group_index itsi_group_id="5a5eb01b-0a1a-45ac-b4c5-15696d3ac9ad" | dedup itsi_group_id | itsi_notable_group_lookup | sendemail "email" subject="$result.itsi_group_description$" message="$result.service_name$ is currently in $result.severity_label$ with a value of $result.severity_value$ at $result.actual_time$

Execute the generated search command and that will show you the fields that are available.

0 Karma

Re: ITSI Notable Event Email Action



Each of the notable events is generated either by a correlation search, multi-kpi alerts, grouping event or alert action. Each one of this carries different $result.fieldnames$.

For the correlation searches and multi-kpi alerts you can check the fields available and their names by executing the search that generated the notable event (Go to Configure -> Correlation Searches and copy the Search string defined).

Also you can check the fields avilable in both the itsitrackedalerts and itsigroupedalerts indexes. Both of then store the notable events generated by ITSI.

index=itsi_grouped_alerts OR index=itsi_tracked_alerts


0 Karma