Splunk Search

Sending entity names in the email triggered from Correlation Searches.


Hi Team,

I have a KPI with split by entity say "Ent1".
I have made a correlation search using this KPI and in the triggered email, i want to send this entity in the subject line.
Can anybody help me in this regard.


0 Karma


ITSI saved correlation searches as alert. Check with token: $result.fieldname$ in the subject.

From SPlunk documentation:
$result.fieldname$: First value for the specified field name from the first search result row. Verify that the search generates the field being accessed.

0 Karma


actually my entity is not coming in the generated search

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!