topic Re: Alert Manager: How to assign a certain incident to an owner based on the results of a search? in All Apps and Add-ons

Alert Manager: How to assign a certain incident to an owner based on the results of a search?

buckiboy — Tue, 12 Jul 2016 08:30:22 GMT

Hello

I am trying to assign certain incident to an owner based on the results of a search. Is this possible? If not, is it possible to parse the value to a tag value?

Thanks

Re: Alert Manager: How to assign a certain incident to an owner based on the results of a search?

Simon — Wed, 13 Jul 2016 09:19:22 GMT

That should be possible when you put

$result.field_from_your_search$

in the "Owner" field of the alert action settings, so something like this:

Note: If there are multiple results, Splunk uses the value from the first row.

Re: Alert Manager: How to assign a certain incident to an owner based on the results of a search?

buckiboy — Wed, 13 Jul 2016 10:03:53 GMT

Thanks

works great.