4 Replies Latest reply on May 11, 2012 2:27 PM by nicole pauls

    e-mail Template Parameter List

    darryld

      I'm sure there is a list somewhere. I've even seen a reference to a list in a blog but I can't find it.

      Could someone help the blind man in the corner and point him in the right direction please.

        • Re: e-mail Template Parameter List
          phil3

          Hi, Darryl.

           

          There isn't really a list of parameters for email templates, as the parameters are really just placeholders for dynamic text from your alerts. For example, I could call a parameter "TGIF" and map that to any alert field from my rule. That said, I think this is the blog post you're referring to: http://thwack.solarwinds.com/message/147581#147581.

           

          We also have a KB article with similar information: SolarWinds Knowledge Base :: Creating Email Templates in the LEM Console

           

          Let me know if you're looking for something different.

           

          Thanks.

           

          Phil

          • Re: e-mail Template Parameter List
            nicole pauls

            Email Templates, ahh, email templates. I put up a post on Thwack that might help - Email Notifications How-To.

             

            The bottom line is the fields you see in the template are fields that you (or we) put there - and you can call them whatever you want. What you put IN them from the correlation depends on what information is important to you that corresponds to that info and gets substituted in when the email is sent. (Whew) Basically, it's pretty dynamic, so there isn't really a static list.

             

            Check out the How-To and see if that helps, come back with any questions!

             

            Edit to add: Phil and I collided mid-stream and basically said the same thing

              • Re: e-mail Template Parameter List
                darryld

                I think I have it now

                 

                You are saying that $TGIF does not get assigned to a variable until the e-mail template is assigned to rule and at this point it can be assigned to any field that the alert in the rule exposes

                 

                Is that correct?

                  • Re: e-mail Template Parameter List
                    nicole pauls

                    Yes, I think so. I'll do a quick example to be sure...

                     

                    If you create an email template with variables:

                    • $FIRST
                    • $SECOND
                    • $THIRD

                     

                    Then make the email body:

                    "$FIRST" from "$SECOND" at "$THIRD"

                     

                    They are placeholders for data you want to bring in from the rule, so that when it fires you know exactly what happened. In the template they don't really mean anything, yet. We named ours with useful names that match the fields in the rules so that it would be easy to use the defaults, but you don't have to do that (that's why you see them with $DetectionTime and $EventInfo - those match default fields that we'd suggest using to make the email make sense).

                     

                    If your rule is "tell me anytime someone fails to log on", your correlation would be:

                    UserLogonFailure EXISTS

                     

                    And you want to be emailed who the user was trying to log on as, from where, and what time, you'd add an email action and in it you'd:

                    • Drag UserLogonFailure.DestinationAccount for $FIRST
                    • Drag UserLogonFailure.SourceMachine for $SECOND
                    • Drag UserLogonFailure.DetectionTime for $THIRD

                     

                    What it does is it pulls the values in memory for that instance of the rule firing, places them into the template, mashes it up, and sends you an email. So your email would look something like:

                    "DOMAIN\User" from "workstation" at "2012-05-11 14:25:00"

                    1 of 1 people found this helpful