Hello Splunk community!
Since a few days I am trying to adjust the output JSON file of the AWS SNS alert.
The alert template for the AWS SNS alert gives me only a specific amount of fields I can "export" into the AWS bucket as a JSON file (to the AWS topic).
But I would like to enter more fields manually. I have already tried to adjust the .py files on the server itself, but I would like to use a self-defined JSON format.
The used search contains all the needed fields, but they are not used by the .py script for sending the alert to AWS.
Has anyone an idea or have already had the same question?
Thanks a lot and happy splunking 🙂
