Splunk Search

Sending entity names in the email triggered from Correlation Searches.

veerendra_modi
Loves-to-Learn

Hi Team,

I have a KPI with split by entity say "Ent1".
I have made a correlation search using this KPI and in the triggered email, i want to send this entity in the subject line.
Can anybody help me in this regard.

Thanks

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

ITSI saved correlation searches as alert. Check with token: $result.fieldname$ in the subject.

From SPlunk documentation:
$result.fieldname$: First value for the specified field name from the first search result row. Verify that the search generates the field being accessed.

0 Karma

veerendra_modi
Loves-to-Learn

actually my entity is not coming in the generated search

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...