https://community.splunk.com/t5/Alerting/Configure-Alert-with-specific-parameters-and-pass-that-data-as/m-p/240821#M4483 <P>Hi </P> <P>You can send some of the information into an alert action but not the results from the query. See here: <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Configuringscriptedalerts">http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Configuringscriptedalerts</A></P> <P>The best option I think is via custom search commands. I am working on one that would hand over results from Splunk search into posteifmsg. I think that's what you are looking for (Should be working ok with nco_postmsg as well) ...<BR /> search would be like<BR /> index=xyz OnCallGroup=*|rename source AS AlertKey|table OnCallGroup AlertKey _time|posteifmsg </P> <P>Thing is: I am somewhat new to python so it'll take some time I think. I will post it to splunkbase once finished.</P> Mon, 10 Oct 2016 14:28:53 GMT hgehrts_splunk 2016-10-10T14:28:53Z https://community.splunk.com/t5/Alerting/Configure-Alert-with-specific-parameters-and-pass-that-data-as/m-p/240820#M4482 <P>I am attempting to find the best way to start sending alerts from Splunk to Netcool OMNIbus and I am finding it a bit challenging. <BR /> One issue I am having is figuring out how to configure Splunk to pass specific information when an Alert Action fires.</P> <P>For example....<BR /> One of the parameters we require are teams to pass when sending an event to OMNIbus is call "OnCallGroup".<BR /> Example: OnCallGroup=ProductionServices</P> <P>I need a way when setting up an Alert Action in Splunk to say that one of the parameters it should pass is OnCallGroup. I see no way to add such extra information to the configuration of the Alert or Trigger Actions. </P> <P>Any ideas?</P> <P>Thanks!</P> Mon, 10 Oct 2016 13:23:45 GMT https://community.splunk.com/t5/Alerting/Configure-Alert-with-specific-parameters-and-pass-that-data-as/m-p/240820#M4482 larryleeroberts 2016-10-10T13:23:45Z https://community.splunk.com/t5/Alerting/Configure-Alert-with-specific-parameters-and-pass-that-data-as/m-p/240821#M4483 <P>Hi </P> <P>You can send some of the information into an alert action but not the results from the query. See here: <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Configuringscriptedalerts">http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Configuringscriptedalerts</A></P> <P>The best option I think is via custom search commands. I am working on one that would hand over results from Splunk search into posteifmsg. I think that's what you are looking for (Should be working ok with nco_postmsg as well) ...<BR /> search would be like<BR /> index=xyz OnCallGroup=*|rename source AS AlertKey|table OnCallGroup AlertKey _time|posteifmsg </P> <P>Thing is: I am somewhat new to python so it'll take some time I think. I will post it to splunkbase once finished.</P> Mon, 10 Oct 2016 14:28:53 GMT https://community.splunk.com/t5/Alerting/Configure-Alert-with-specific-parameters-and-pass-that-data-as/m-p/240821#M4483 hgehrts_splunk 2016-10-10T14:28:53Z https://community.splunk.com/t5/Alerting/Configure-Alert-with-specific-parameters-and-pass-that-data-as/m-p/240822#M4484 <P>That is EXACTLY what I would be after <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> <BR /> I see, so you are finding the OnCallGroup information from a lookup table in Splunk. Correct?</P> <P>Good info! Yes, please keep me posted on your progress as I would be very interested in this once you have it.</P> Mon, 10 Oct 2016 14:41:51 GMT https://community.splunk.com/t5/Alerting/Configure-Alert-with-specific-parameters-and-pass-that-data-as/m-p/240822#M4484 larryleeroberts 2016-10-10T14:41:51Z