Hi all, I am using slack_alerts addon to send Slack messages.
It allows for use of tokens in the message body as referenced here https://docs.splunk.com/Documentation/Splunk/8.1.3/Alert/EmailNotificationTokens
(E.G AWS CloudTrail events) I am trying to figure out a way that I can either:
a) Have various fields renamed to a single field (such as a security group ID, or a bucket name be rewritten to field called "resource") so that I can reference this field in my token ($result.resource)
b) have a dynamic token that looks at various fields
Currently I just have a line in my alert that looks like:
*Resource:* `$result.requestParameters.policyName$ $result.requestParameters.policyArn$ $result.requestParameters.groupId$ $result.responseElements.groupId$ $result.requestParameters.groupDescription$ $result.requestParameters.bucketName$`
but this is messy and the results show up with spaces before and after the value
I was wondering if strcat is the right search expression to use for this, the search runs in realtime so it shouldnt make a jumble fo 2 or 3 resources in a single line?
Hoping someone will have some useful insight
