Alerting

Adding all lines of results of search as a note to SOAR system?

onurasln55
Explorer

Let's say I have a query like "index=myindex honor | stats count by mydata,mydata2". I want to add the results of this query as a note in my soar system. My problem starts exactly at this point. If the result of my query is 1 row, there is no problem, but when more than one row results, I can only add the first row as a note. I am sending the data in the form of "$result.mydata$" and "$result.mydata2$" to the soar system. I want to print the whole line, not a single line. that is, as a result, I want to direct all the results in the incoming table and add them to the query.

thanks

Labels (1)
Tags (2)
0 Karma

Gr0und_Z3r0
Contributor

Hi @onurasln55 

I'm trying to understand the problem and am assuming, you want to send the whole result table mydata,mydata2 and count as a single line to wherever you want.

If so, here is an example where i have 3 columns and sending it as one liner

Gr0und_Z3r0_0-1680685939881.png

index=_internal 
| fields eventtype log_level 
| stats count by eventtype log_level 
| eval a = eventtype +"," +log_level+"," +count 
| fields a 
| mvcombine a delim=";"
| nomv a

 

~ If the reply helps, an upvote would be appreciated.


Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...