https://community.splunk.com/t5/Alerting/Alert-Action-Log-Event/m-p/531880#M10015 <P>Hello Everyone,<BR />Is there a way to utilize the new fields extracted from logs that Splunk intakes and use in the alert action log event side and make the alert event log more dynamic?<BR /><BR />sample splunk intake log :- {\"event_type\":\"FAILED_LOGIN\",\"event_id\":\"f0836a4a-9e4a-4914-b52c-010ecb0916f8\",\"type\":\"event\",\"created_at\":\"2020-11-13T21:30:09+05:30\",\"created_by\":{\"login\":\"\",\"type\":\"user\",\"id\":\"2\",\"name\":\"Unknown user\"},\"source\":{\"login\":\"rahulmishra1329@gmail.com\",\"type\":\"user\",\"id\":\"14044224420\",\"name\":\"Rahul Mishra\"},\"session_id\":null,\"additional_details\":null,\"action_by\":null,\"ip_address\":\"117.211.192.31\"}<BR /><BR />new field extracted :-&nbsp;event_type</P> Thu, 03 Dec 2020 14:38:34 GMT seceontest 2020-12-03T14:38:34Z https://community.splunk.com/t5/Alerting/Alert-Action-Log-Event/m-p/531880#M10015 <P>Hello Everyone,<BR />Is there a way to utilize the new fields extracted from logs that Splunk intakes and use in the alert action log event side and make the alert event log more dynamic?<BR /><BR />sample splunk intake log :- {\"event_type\":\"FAILED_LOGIN\",\"event_id\":\"f0836a4a-9e4a-4914-b52c-010ecb0916f8\",\"type\":\"event\",\"created_at\":\"2020-11-13T21:30:09+05:30\",\"created_by\":{\"login\":\"\",\"type\":\"user\",\"id\":\"2\",\"name\":\"Unknown user\"},\"source\":{\"login\":\"rahulmishra1329@gmail.com\",\"type\":\"user\",\"id\":\"14044224420\",\"name\":\"Rahul Mishra\"},\"session_id\":null,\"additional_details\":null,\"action_by\":null,\"ip_address\":\"117.211.192.31\"}<BR /><BR />new field extracted :-&nbsp;event_type</P> Thu, 03 Dec 2020 14:38:34 GMT https://community.splunk.com/t5/Alerting/Alert-Action-Log-Event/m-p/531880#M10015 seceontest 2020-12-03T14:38:34Z