Alert Trigger Description Field

[shusseina]

Looking at an existing alert trigger, I notice the description field includes variables of some sort.

e.g.

$result.User$

$result.Message$

Where can I find more information about these variables? What other variables are available to include in the alert description?

Thanks

Steve

[ITWhisperer]

These are values of the fields from the first row of the search

[shusseina]

Yep, we figured that.

Is there documentation about $Result and what other attributes, if any, it has.

Thanks

Steve

[ITWhisperer]

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2109/AdvancedDev/ModAlertsLog