ITSI Notable Event Email Action

[Justinboucher0]

What are the actual $result.fieldname$ tokens that are available in ITSI Notable Events for the Send to Email action. I'm trying to access the notable event title, description, and whatever other fields I can access from the notable event.

[jaime_ramirez]

Hi

Each of the notable events is generated either by a correlation search, multi-kpi alerts, grouping event or alert action. Each one of this carries different $result.fieldnames$.

For the correlation searches and multi-kpi alerts you can check the fields available and their names by executing the search that generated the notable event (Go to Configure -> Correlation Searches and copy the Search string defined).

Also you can check the fields avilable in both the itsi_tracked_alerts and itsi_grouped_alerts indexes. Both of then store the notable events generated by ITSI.

index=itsi_grouped_alerts OR index=itsi_tracked_alerts

Cheers!!!

[roman3ro]

Take a look at this search from the _internal index:

index=_internal sendemail sourcetype=itsi_internal_log

And you should see the search that ITSI is running. That will look something like this:

2019-07-09 11:53:02,134 INFO [itsi.controllers.itoa_rest_interface_provider] [notable_event_actions] [execute_action] [9969] Generated search command= search itsi_event_management_group_index itsi_group_id="5a5eb01b-0a1a-45ac-b4c5-15696d3ac9ad" | dedup itsi_group_id | itsi_notable_group_lookup | sendemail "email" subject="$result.itsi_group_description$" message="$result.service_name$ is currently in $result.severity_label$ with a value of $result.severity_value$ at $result.actual_time$

Execute the generated search command and that will show you the fields that are available.