Alerting

Error message gets truncated when alert email is sent

osubbu
New Member

Error message is of many lines for example this is one error message which we get when we use the same query on the search bar:
ErrorMessage=The Event [CONFIRM] is not valid for the state [KITTING_COMPLETED]
com.essilor.crimson.cosmic.store.exception.OrderTransitionException: The Event [CONFIRM] is not valid for the state [KITTING_COMPLETED]
at sun.reflect.GeneratedConstructorAccessor433.newInstance(Unknown Source)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)

But when we set the alert we get only the first word in the message, Is there any limit on the alert email sent. please any idea.

ErrorMessage=The

Tags (1)
0 Karma

DalJeanis
Legend

Look in the fields on the left side of the search. Click on ErrorMessage. See if "The" is a value shown there.

If so, this indicates that your parsing for field ErrorMessage is not set up correctly, and is stopping at the first space.

So you need to update the conf that defines that extraction. Post here when you have looked, and tell us what you see. Then we can walk you through the fix.

0 Karma

osubbu
New Member

Hi Daljeanis, Thanks for the reply and yes i see only the value "The" when i see under the interested fields as you suggested, error message extraction is stopping at the first space and displaying only that. can you please help me where i could fix this in which conf file.

0 Karma

elliotproebstel
Champion

If you run the alert search manually and look at the field in question, is it getting parsed correctly there? It could be as simple as a misconfigured field extraction.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...