Hello all, is there a token usable in the Email alert body that indicates the Trigger Condition?
I'm using a "Customer" trigger condition and would like to include it in the email to normalize expectations.
From the documentation page (http://docs.splunk.com/Documentation/Splunk/6.3.2/Alert/Emailnotification), I see both `$trigger_date` and `$trigger_time$` but no `$trigger_condition$` or similar. Is there an undocumented token for this?
I could try to re-write the search string to include the condition but that's not exactly desirable for a few different reasons. Anyway, this seems like an obvious token that should be in place already.
↧