Splunk IT Service Intelligence

Splunk IT Service Intelligence: Notable Event Policy Email Tokens

andykoopa
New Member

Hi,

I am trying to include a url for a report in my notable event email. I would like the url to use the result time token as the latest field, and the time-60m as the earliest. So that if I check the email hours later I can still see the report from the events time frame.

Example url in email message body:
Report:
https://blahblahblahReport&earliest=&amplatest=

I have tried:
https://blahblahblahReport&earliest=$result._time$-60m&amplatest=$result._time$
AND
https://blahblahblahReport&earliest=$result._time-60m$&amplatest=$result._time$

But they do not seem to work. The result._time value itself is fine, it is a matter of doing the result._time-60m for earliest. If I hard code the values it works so I know it is possible with the configured report.

Has anyone had experience in doing this? I appreciate the time and help 🙂

-Andy

0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

Hi Andy, here are the docs for configuring tokens in emails. If this doesn't help, please let me know how we can enhance the docs https://docs.splunk.com/Documentation/ITSI/latest/User/Setupandrunnotableeventactions#Send_an_email

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...