topic Re: Which field to store meta data about alert begin deployed in Alerting

Which field to store meta data about alert begin deployed?

mosh — Fri, 10 Jun 2022 18:59:12 GMT

I want to save some meta-data (operational history of the alert (beyond the text description)) along with alert as a json object in a field. This is from automated pipelines using sdk (nodejs/python) and POST API to splunk servers.

Re: Which field to store meta data about alert begin deployed

richgalloway — Fri, 10 Jun 2022 18:57:50 GMT

Once events have been indexed (stored) no new fields can be added. If you need to store additional information then you have a few options:

Write it to a lookup file
Write it to the KVStore
Write it to a summary index (or a regular index)

Re: Which field to store meta data about alert begin deployed?

mosh — Wed, 15 Jun 2022 22:10:19 GMT

This has to part of savedsearch (alert/correlation search param), before it is deployed/updated, but should not affect splunk actions in anyway. Otherwise I can manage it myself (outside of splunk) as I do right now.