Splunk Search

Can you put a non-tabled field in an alert title?

nick405060
Motivator

I want to be able to put a token in my alert title that is derived from a field NOT in the displayed results table.

How? The below does not work:

| makeresults | eval a="junk" | eval b="junk" | eval _a=a | table b + Splunk Alert: $name$ $result._a$

nick405060
Motivator

99% sure this is a bug. It seems the table, fields, and stats commands breaks the tokenization of hidden fields. Per the below, and per other users I have talked to on 7.3, this issue exists from at least version 7.0 forwards.

https://answers.splunk.com/answers/342128/why-does-resultfieldname-token-not-work-in-alert-e.html

@the_tick mentioned maybe using field aliases to workaround, or sendalert. I haven't tried either of those workarounds yet, but this was my solution:

| makeresults | eval a="mysubject" | eval b="mycontent" | map maxsearches=10000 search="| makeresults | eval b=\"$b$\" | table b | sendemail server=smtp.gadsden.com to=\"myemail@gadsden.com\" subject=\"$a$\" message=\"Results:\" sendresults=true inline=true"

To adapt this template to your search, simply calculate the fields that you'll want to tokenize, before the map, and dedup to only be one row of data (e.g. you probably won't be using makeresults). Next, in the map, write your actual alert and in sendemail you can now use the calculated tokens from before the map.

This is a sanitized example of my query:

index=wineventlog (EventCode=4771 OR EventCode=4776 AND Keywords="Audit Failure") user=amkfk NOT Source_Workstation="TABLET3849" NOT Source_Workstation="TOKYO_OFFICE" NOT Source_Workstation="MKK_SURFPRO7"| rex field=_raw "Error Code:\s+(?<error_code>\S+)" | stats values(error_code) AS error_codes | eval error_codes=mvjoin(error_codes,",") | table error_codes |
map maxsearches=10000 search="search index=wineventlog (EventCode=4771 OR EventCode=4776 AND Keywords=\"Audit Failure\") user=amkfk NOT Source_Workstation=\"TABLET3849\" NOT Source_Workstation=\"TOKYO_OFFICE\" NOT Source_Workstation=\"MKK_SURFPRO7\" | rex field=_raw \"Error Code:\s+(?<error_code>\S+)\" | sort 0 _time | table _time user EventCode Source_Workstation ComputerName Keywords error_code | sendemail server=smtp.mydomain.com to=\"myemail@mydomain.com\" subject=\"Splunk Alert: amkfk_4771_4776 ($error_codes$)\" message=\"Results:\" sendresults=true inline=true"

to4kawa
Ultra Champion

eval _subject=subject

underbar field is unvisible.
you should change field name.

action.email.subject.alert = Splunk Alert: $name$ ($result._subject$)
don't forget this ,too.

0 Karma

nick405060
Motivator

I changed the field name to mysubject - both in the SPL and in the alert subject - with the same result.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...