Splunk Search

Variable reference in To: field of an email alert.

mdzmuran
Observer

Hi Splunk Team.

Can I use variable reference in To: field of an email alert? I have a distribution_list variable associated with my sourcetype and it is set to correct email address depending on date and time.  

U put $result.distribution_list$ in the To: field, but it does not send email.

Thanks

Michal

Labels (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @mdzmuran 

Yes you can use $result.distribution_list$ format in TO: field, however the search results should be having the value populated to distribution_list field, did you verify it?

How are you so sure email not been sent just checking the inbox ? Sometimes the Splunk user has been restricted to schedule alerts. Can you run following query to find out errors associated to your alert?

 

index=_internal source=*scheduler.log ERROR OR WARN

 

 To find send email errors,

 

index=_internal source=*python.log sendemail ERROR OR WARN

 

Hope mail server already configured in Splunk.

---

An upvote would be appreciated and Accept solution if this reply helps!

 

0 Karma

mdzmuran
Observer

HIi venkatasri.

The alerts are triggered, I can see them in Triggered alerts.

If I replace $result.distribution_list$ with regular email address, the emails are sent.

The queries suggested do not return any data. It may be due to access permissions, I asked administrators to run them.

One more info, it may be important. The distribution_list variable is not defined in the search query. It is defined in the Calculated Fields setting for this particular sourcetype. I can see it, however, in the search results if I run the alert query manually.picture.jpg

Michal

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@mdzmuran 

As per docs the field shall be explicitly available in results.  Try including distribution_list to results using | fields command. Hope this helps!

$result.fieldname$First value for the specified field name from the first search result row. Verify that the search generates the field being accessed.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...