Please share some documents which will help me achieve this?? Since I am new to splunk and created a report but would need to modify email format
... View more
Can a html dashboard be sent on email?? I have created an html dashboard with modified css and html code and I want that to be sent as email??
... View more
my report generates host, eventcode, time, Message however, my report generated on Splunk email Body is not formatted properly. how to format a report email body for report to look more Effective and well formated??
... View more
Thank you for your reply will this query work only for the defined subject or for any subject line which has server in uppercase letter??
... View more
please see this subject line if my first query fetches host wsini606xasi01 and when it matches with above subject based on regex query In which wsini606xasi01 is in uppercase it does not displays incident in another column. When 1st query and 2nd query both are in lower case host matches and displays incident.
... View more
my query fetches (host, incident) from subject line by using below regex command regex field=subject max_match=0 “(<Incident>INC\d{12})” | regex field=subject “(?<host>[a-z]{5}\d{3}\d[a-z]{4}\d\d)“ my query matches host from 1st query (1st query displays host based on some eventcode) and those host search for host in subject line and displays incident in separate column. however, incident is not fetched for host which are in uppercase Letter in subject and incident column remains blank for particular host.
... View more
thank you for your reply!! however, My query rex field=subject max_match=0 "(?<Incident>INC\d+)" works fine for Eg1 in which INC is appended by space in subject line. however, for eg2 INC is appended by | in this case Incident number is not fetched. eg 1:- RE: INC0000756784 | server is unreachable eg 2:- RE:INC0000564789|Minor|server unreachable
... View more
Thank you for your help however, query did not work with the entire query. For the other subject line my query works but only for this specific subject it doesnt i believe is the issue with the | sign just after the incident??
... View more
I am using below query to fetch Incident from the subject line:— rex field=subject max_match=0 “(?<Incident>INC\d+)” however, for below subject line i am unable to fetch incident:— [SecMail:] INC000027755501|TAS00003760220 wrdna904xusa73|server is unreachable | INC000027790458| INC000027882562
... View more
I am using below query to fetch Incident from the subject line:— rex field=subject max_match=0 “(?<Incident>INC\d+)” however, for below subject line i am unable to fetch incident:— [SecMail:] INC000027755501|TAS00003760220 wrdna904xusa73|server is unreachable | INC000027790458| INC000027882562
... View more
This worked but it is not displaying Host from query 1 even if it doesnt find any host in query 2?? my requirment is to match host but also display all output fro. Query 1??
... View more
Query 1 displays ( Host, Time, Eventcode, Message) Query 2 displays ( subject, Host, Incident) i want to all match hosts in both column and based on that join the querys to display ( Host, Time, Eventcode, Message, incident)
... View more
How can i join two query table based on common column ( host), but i want to display all columns from 1st table but just 1 column ( Incident column) from 2nd table??
... View more
How to use Regex query to separate servername which has different names eg:- WSINI601XASI01 WRDNA502XUSA05 WGBR601XGBR11 from below subject lines:— 1. INC000027679570 | WSINI601XASI01| scom exchange 2k16: Failed to connect to computer 2. Wo# 1197736/ INC00027697776/ please perform hardware diagnostic on WRDNA502XUSA05
... View more
How to use below query to separate servername which has different names eg:- WSINI601XASI01 WRDNA502XUSA05 WGBR601XGBR11 from below subject lines:— 1. INC000027679570 | <servername> | scom exchange 2k16: Failed to connect to computer 2. Wo# 1197736/ INC00027697776/ please perform hardware diagnostic on <servername>
... View more