Alerting

Alert tokens and dynamic fields

poiromaniax
Engager

Hi all, I am using slack_alerts addon to send Slack messages.

It allows for use of tokens in the message body as referenced here https://docs.splunk.com/Documentation/Splunk/8.1.3/Alert/EmailNotificationTokens

(E.G AWS CloudTrail events) I am trying to figure out a way that I can either:

a) Have various fields renamed to a single field (such as a security group ID, or a bucket name be rewritten to field called "resource") so that I can reference this field in my token ($result.resource)

b) have a dynamic token that looks at various fields

Currently I just have a line in my alert that looks like:

 

*Resource:* `$result.requestParameters.policyName$ $result.requestParameters.policyArn$ $result.requestParameters.groupId$ $result.responseElements.groupId$ $result.requestParameters.groupDescription$ $result.requestParameters.bucketName$`

 

 but this is messy and the results show up with spaces before and after the value


I was wondering if strcat is the right search expression to use for this, the search runs in realtime so it shouldnt make a jumble fo 2 or 3 resources in a single line?

Hoping someone will have some useful insight

Labels (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!