Alerting

Is it possible to use fields from events to populate email alert variables?

tkwaller
Builder

Hello everyone

I'm am trying to find if you can use fields from events to populate email alert variables. As an example, say I have the following event that triggers an alert:

Sample log format

14:09:22.686 [eventsJmsContainer-1] INFO   _message="Ready to send email" jobGUID=999999999999, emailTo=example@somewhere.com, emailCC=, subject=Job Status Report for Job ID 1050221354, emailText=Job Summary:

Job Unique ID: 1440104961583
Job status: COMPLETED
Job Details: Enrichment: File Name="events.csv_1440104961583", Unique ID=1440104961583, User="testuser@somewhere.com", Source="MySource"
Result: Total Records = 1, # Passed = 0, # Failed = 1
Start Time: Aug 20, 2015 2:09:22 PM
End Time: Aug 20, 2015 2:09:22 PM
Duration (seconds): 0

Row-level Failures (if any):

Entity ID: abcd1234
com.somewhere.domain.mydomian.mytools.v1.common.exception.ReadAPIException: Unexpected character ('<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
 at [Source: protocol.http.HttpURL.HttpInputStream@999abc123; line: 1, column: 2]

What I would like to do is have the email alert use the "emailTo" field to set the email to address, the "emailCC" field to set the CC address, "subject" field to set the subject of the email and the "emailText" field to populate the body of the email.

Is this a possibility?
Thanks for any input!

1 Solution

woodcock
Esteemed Legend

The only way to do this is to set it as an Alert and have the Alert call a script. In the script you can access the search results and do whatever you like with it. Once this is done, you can call sendmail or whatever directly from the script.

View solution in original post

sandyasampath
New Member
0 Karma

johnsjm
Explorer

The only reason a script would be needed is if a CC email header was absolutely required, why not put all recipients into the "To:" field: $result.emailTo$, $result.emailCC$, Subject: $result.subject$ and the Body of the message could be eval'ed first and then just set to $result.emailText$.

0 Karma

Cesaredf
Explorer

I just want to confirm that in 6.1 via web interface the variable $result.host$ works too.

gbower333
Path Finder

In 6.2 I have been able to add a host value into email alert subjects by adding a variable. In savedsearches.conf under the alert stanza:
action.email.subject = $name$ : $result.host$
You can also add the variable via the web interface.
I am not sure about custom fields though.

woodcock
Esteemed Legend

The only way to do this is to set it as an Alert and have the Alert call a script. In the script you can access the search results and do whatever you like with it. Once this is done, you can call sendmail or whatever directly from the script.

tkwaller
Builder

That's what I had anticipated but just wanted to check before diving in. Thanks for the advice!

0 Karma

johnsjm
Explorer

I had to re-read the question again but the only reason a script would be needed is if a CC email header was absolutely required, why not put all recipients into the "To:" field: $result.emailTo$, $result.emailCC$, Subject: $result.subject$ and the Body of the message could be eval'ed first and then just set to $result.emailText$.

0 Karma

marcoscala
Builder

Hi! I DO need to do the same BUT with the action.email.to field! I get the recipient in a lookup!

The UI doesn't like $result.resp_email$ (resp_email is my field with the email of the recipient).
Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...