Alerting

Reports Have Changed Since Upgrade to Splunk 6.1

ezajac
Path Finder

I have just upgraded to Splunk 6.1. I have daily reports that are sent from Splunk. Before the upgrade the report would get sent and the content of the report would be in the header as well as a record count. Now there is a link to the report in Splunk where you can get the details. How can I get back at a bare minimum the total count of rows returned in the report without clicking on the link?

Tags (4)

ChrisG
Splunk Employee
Splunk Employee

If you are talking about email alerts, in Splunk Enterprise 6.1 you can customize the email using tokens. See the Set up alert actions topic in the Alerting Manual for the specifics.

0 Karma

ezajac
Path Finder

To add Row Count, would savedsearches.conf have this configuration now? Where $job.result.Count$ is new?

[Issue Policy Numbers from States]
action.email = 1
action.email.inline = 1
action.email.reportServerEnabled = 0
action.email.sendresults = 1
action.email.subject = Splunk Alert: ReportName
action.email.to = email addresses
alert.digest_mode = True
more configurations here
vsid = hmm5pnnl
$job.resultCount$

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...