Alerting

Alert tokens and dynamic fields

poiromaniax
Explorer

Hi all, I am using slack_alerts addon to send Slack messages.

It allows for use of tokens in the message body as referenced here https://docs.splunk.com/Documentation/Splunk/8.1.3/Alert/EmailNotificationTokens

(E.G AWS CloudTrail events) I am trying to figure out a way that I can either:

a) Have various fields renamed to a single field (such as a security group ID, or a bucket name be rewritten to field called "resource") so that I can reference this field in my token ($result.resource)

b) have a dynamic token that looks at various fields

Currently I just have a line in my alert that looks like:

 

*Resource:* `$result.requestParameters.policyName$ $result.requestParameters.policyArn$ $result.requestParameters.groupId$ $result.responseElements.groupId$ $result.requestParameters.groupDescription$ $result.requestParameters.bucketName$`

 

 but this is messy and the results show up with spaces before and after the value


I was wondering if strcat is the right search expression to use for this, the search runs in realtime so it shouldnt make a jumble fo 2 or 3 resources in a single line?

Hoping someone will have some useful insight

Labels (1)
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...