Alert tokens and dynamic fields

poiromaniax — Wed, 21 Apr 2021 08:55:25 GMT

Hi all, I am using slack_alerts addon to send Slack messages.

It allows for use of tokens in the message body as referenced here https://docs.splunk.com/Documentation/Splunk/8.1.3/Alert/EmailNotificationTokens

(E.G AWS CloudTrail events) I am trying to figure out a way that I can either:

a) Have various fields renamed to a single field (such as a security group ID, or a bucket name be rewritten to field called "resource") so that I can reference this field in my token ($result.resource)

b) have a dynamic token that looks at various fields

Currently I just have a line in my alert that looks like:

*Resource:* `$result.requestParameters.policyName$ $result.requestParameters.policyArn$ $result.requestParameters.groupId$ $result.responseElements.groupId$ $result.requestParameters.groupDescription$ $result.requestParameters.bucketName$`

but this is messy and the results show up with spaces before and after the value

I was wondering if strcat is the right search expression to use for this, the search runs in realtime so it shouldnt make a jumble fo 2 or 3 resources in a single line?

Hoping someone will have some useful insight

topic Alert tokens and dynamic fields in Alerting

Alert tokens and dynamic fields