Alerting

Inbuilt token in email alert is only sending first result, not all results from the column

amalkapuram
New Member

Hello Splunkers,

I am trying to setup the alerts go to email and other integrations. When I use the inbuilt tokens like "$results.x$"- it gives only the first result from the search. How should I access other fields from the search results?

My search is something like this: index=* "xxxxxx" |.....|stats count by domain, name, ip

This search usually gives 3-4 unique columns like this-
| Domain | Name | IP |
| A | B | C |
| D | E | F |
| H | I | J |

Email alert should have all the results(columns) in it. Please help.

Thanks in advance.

0 Karma

unstable23
New Member

Had the same problem but figured it out from looking at notable events, which behave the 'right' way.

At least in 7.2.x, you need to set

alert.digest_mode = 0

on the search in savedsearches.conf.
After that, using the $result.foo$ tokens in alerts will give you each of the events not just the first.

By default it's set to 1/true.

0 Karma

hardikJsheth
Motivator

I think you are using Trigger= "once" option for your alert. In case you wish to send information for each row, you can change this option to "For each result".

With this option you will be able to get appropriate value for each token $result.$. However it will trigger as many mails as number of results.

0 Karma

niketn
Legend

@amalkapuram, $result.<fieldname>$ token is built to pull only the first row. You either need to have your query to filter to specific row you are interested in, or may be try transpose command to have results in single row (not sure if it is possible for three columns in your case).

Refer to Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens#Result_tokens

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...