topic Re: Add entry data to an alert in Splunk Search

Add entry data to an alert

mwcentracomm — Thu, 15 Feb 2024 15:03:48 GMT

I am using the search below

| metadata type=hosts | where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen

I would like to add a field populated by somename that ends in "srx"

Jan 4 13:07:57 1.1.1.1 1 2024-01-04T13:07:57.085-05:00 5995-somename-srx rpd 2188 JTASK_SIGNAL_INFO [junos@2636.1.1.1.2.133 message-name="INFO Signal Info: Signal Number = " signal-number="1" name=" Consumed Count = " data-1="3"]

Re: Add entry data to an alert

richgalloway — Thu, 15 Feb 2024 13:34:12 GMT

Use the eval command to add a field to your results.

Re: Add entry data to an alert

mwcentracomm — Thu, 15 Feb 2024 18:14:19 GMT

Sorry, I did not completely explain, - I would like it to return the full name ending in srx.

Re: Add entry data to an alert

richgalloway — Thu, 15 Feb 2024 18:23:11 GMT

Only the fields provided by the metadata command can be displayed unless you add other commands that search indexes for names ending with "srx". If the desired field *is* returned by metadata then include it in the fields command then use where or search to filter the desired values.