Splunk Search

Can you put a non-tabled field in an alert title?

nick405060
Motivator

I want to be able to put a token in my alert title that is derived from a field NOT in the displayed results table.

How? The below does not work:

| makeresults | eval a="junk" | eval b="junk" | eval _a=a | table b + Splunk Alert: $name$ $result._a$

nick405060
Motivator

99% sure this is a bug. It seems the table, fields, and stats commands breaks the tokenization of hidden fields. Per the below, and per other users I have talked to on 7.3, this issue exists from at least version 7.0 forwards.

https://answers.splunk.com/answers/342128/why-does-resultfieldname-token-not-work-in-alert-e.html

@the_tick mentioned maybe using field aliases to workaround, or sendalert. I haven't tried either of those workarounds yet, but this was my solution:

| makeresults | eval a="mysubject" | eval b="mycontent" | map maxsearches=10000 search="| makeresults | eval b=\"$b$\" | table b | sendemail server=smtp.gadsden.com to=\"myemail@gadsden.com\" subject=\"$a$\" message=\"Results:\" sendresults=true inline=true"

To adapt this template to your search, simply calculate the fields that you'll want to tokenize, before the map, and dedup to only be one row of data (e.g. you probably won't be using makeresults). Next, in the map, write your actual alert and in sendemail you can now use the calculated tokens from before the map.

This is a sanitized example of my query:

index=wineventlog (EventCode=4771 OR EventCode=4776 AND Keywords="Audit Failure") user=amkfk NOT Source_Workstation="TABLET3849" NOT Source_Workstation="TOKYO_OFFICE" NOT Source_Workstation="MKK_SURFPRO7"| rex field=_raw "Error Code:\s+(?<error_code>\S+)" | stats values(error_code) AS error_codes | eval error_codes=mvjoin(error_codes,",") | table error_codes |
map maxsearches=10000 search="search index=wineventlog (EventCode=4771 OR EventCode=4776 AND Keywords=\"Audit Failure\") user=amkfk NOT Source_Workstation=\"TABLET3849\" NOT Source_Workstation=\"TOKYO_OFFICE\" NOT Source_Workstation=\"MKK_SURFPRO7\" | rex field=_raw \"Error Code:\s+(?<error_code>\S+)\" | sort 0 _time | table _time user EventCode Source_Workstation ComputerName Keywords error_code | sendemail server=smtp.mydomain.com to=\"myemail@mydomain.com\" subject=\"Splunk Alert: amkfk_4771_4776 ($error_codes$)\" message=\"Results:\" sendresults=true inline=true"

to4kawa
Ultra Champion

eval _subject=subject

underbar field is unvisible.
you should change field name.

action.email.subject.alert = Splunk Alert: $name$ ($result._subject$)
don't forget this ,too.

0 Karma

nick405060
Motivator

I changed the field name to mysubject - both in the SPL and in the alert subject - with the same result.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...