Splunk Search

Sending entity names in the email triggered from Correlation Searches.

New Member

Hi Team,

I have a KPI with split by entity say "Ent1".
I have made a correlation search using this KPI and in the triggered email, i want to send this entity in the subject line.
Can anybody help me in this regard.

Thanks

0 Karma

Influencer

ITSI saved correlation searches as alert. Check with token: $result.fieldname$ in the subject.

From SPlunk documentation:
$result.fieldname$: First value for the specified field name from the first search result row. Verify that the search generates the field being accessed.

0 Karma

New Member

actually my entity is not coming in the generated search

0 Karma