Hello Everyone,
Is there a way to utilize the new fields extracted from logs that Splunk intakes and use in the alert action log event side and make the alert event log more dynamic?
sample splunk intake log :- {\"event_type\":\"FAILED_LOGIN\",\"event_id\":\"f0836a4a-9e4a-4914-b52c-010ecb0916f8\",\"type\":\"event\",\"created_at\":\"2020-11-13T21:30:09+05:30\",\"created_by\":{\"login\":\"\",\"type\":\"user\",\"id\":\"2\",\"name\":\"Unknown user\"},\"source\":{\"login\":\"rahulmishra1329@gmail.com\",\"type\":\"user\",\"id\":\"14044224420\",\"name\":\"Rahul Mishra\"},\"session_id\":null,\"additional_details\":null,\"action_by\":null,\"ip_address\":\"117.211.192.31\"}
new field extracted :- event_type
