Splunk Search

Email from Splunk

viksvig
Loves-to-Learn Lots

I have splunk search - index=cloud EventName: "Error Occurred" XChangeToSalesForce | rename message as "Message" _time as Time | table Time,Message

When i search on splunk search, i get the below response

1637759064  Multiple Terms found for the same agency. Agency code: 

But when the email is sent, i get nothing on the message field

Time

Message

1637759064 

 

Labels (1)
Tags (1)
0 Karma

johnhuang
Motivator

How is the email formatted? Are you inserting the results as an inline table?

0 Karma

Siddharth
Path Finder

Try to add the results in some log or lookup and check the output 

In case if it is empty check the data and if not try to send the alert to your mail id using  this 

| makeresults | eval a = temp | table  a _time

and use inline table in your alert 

0 Karma

viksvig
Loves-to-Learn Lots

@johnhuang  it is formatted as inline table, i tried inline raw as well

0 Karma

viksvig
Loves-to-Learn Lots

@johnhuang  any idea why it is skipping the Messages

0 Karma

johnhuang
Motivator

Could you post a sample of the search result and also the email template config.

0 Karma

viksvig
Loves-to-Learn Lots

viksvig_0-1638384842160.png

This is the search and I am getting the desired result here. But when Email is sent the Message field blanks out

viksvig_1-1638384948005.png

 

0 Karma

viksvig
Loves-to-Learn Lots

viksvig_0-1638385016488.png

 

0 Karma

johnhuang
Motivator

That's strange and interesting. Lets rule out a few things.

1. Could you enable the options "Attach CSV" and "Attach PDF"? Run another test and see if the data is in the attachments.

2. Let's replace the data in Message with safe characters and see if that works.

| eval message="testing_"._time

 

 

 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...