How to create a custom alert based on job failures that includes job name in subject title?

[sudhakar419]

Hi,

We are planning to create alerts based on the search pattern we are given. We are very new and need your suggestions for this.

We want to create an alert in case of any job failure. For that we used " index="3977"  "Exit status 1". If we do it this way we are getting an alert email as expected.

What we are trying to do is include the job name in the email since we have 20 jobs and are not sure which alert is being triggered for which job. If we apply a separate alert as index="3977" "job_name", we are getting results but we can't track the job status from the same chunk log in Splunk, both are in separate chunks.

How can we achieve this????

[gcusello]

Hi @sudhakar419,

you can add a token (one or more values from the search) to your email notification.

You can find informations about this at https://docs.splunk.com/Documentation/Splunk/8.0.5/Alert/EmailNotificationTokens

You can add Search ID as $job.sid$ or Search Job Name as $job.label$ or a field from your search $result.fieldname$

Ciao.

Giuseppe

[sudhakar419]

Thank you so much for your reply.i would like to add some more details here. In my post I mentioned the job name here job names we have Control M jobs and runs on Gaia platform. We have been watching job status in Splunk.in case of any error we can able to create alert by adding index="54367' ' Exit status code=1'. In case of any error exit code is 1 is showing in log, so we are getting email as per alert setup. Now we need to add the Control M job name in Email.As per your post $app.label$ shows our control M job name?? Please suggest.

[gcusello]

hi @sudhakar419,

as I said, you can add a field of your search to the email notification.

So if "Control M job name" is a field name in your search (object of a table or stats command) you can pass it as a token to the search.

To do this: if in your search the field name of job name is "job_name" , e.g. something like this:

 index="3977"  "Exit status 1"
| table job_name

in your email you can use the token $result.job_name$

Only one hint: don't use fields with space in the middle (e.g. "job name").

Ciao.

Giuseppe