Can I get the raw events (Results of the search) in an Alert Email?

[vinodmadaan]

Hi,

I am looking for a way to get the events in the alert email rather than the statistics i.e. I want to see what "view result" link shows on click on splunk page directly into the email.

Is this even possible?

Thanks in advance.
Vinod.

[stephanefotso · Accepted solution]

Yes : You can include Inline listing of results, as a table, raw events, or CSV file whent configuring your email actions.
For more informations, take a look here: http://docs.splunk.com/Documentation/Splunk/latest/Alert/Setupalertactions

[vinodmadaan]

Hi Stephanefotso,

Thanks for the reply, But this not what I am asking for sorry. I know we can include all this, but what I want it to get the events like they come up when we do a search by typing the query (I hope it is making sense what I am asking) with all the stuff like source type host etc etc.

[stephanefotso]

you can get raw events. Let suppose You create an alert that send an email when the word error is find for the last 1 hours and it would send an email when found.
Here is the query with the _internal index: index=_internal "error" . A search like this will provide events, that you can decide to get in your mail the same way you get it in splunk web when simply type the query, by silply include raw events when configuring your email action.

[vinodmadaan]

Gotcha! Sorry I got confused.
Thank you so much for you answer 🙂