Alerts - enrichment

[mathewboarman]

I have a search defined to trigger an alert...

eg
search all failed logins and count by user_name
If the number of failed logins > 5 in time_frame, then trigger alert.

This works fine... I get an alert telling me that the Alert_ has triggered....

But this is not much information... The information content of the alert should at least contain the name of the user who failed to login 5 times.

In general I'm asking for the ability to pass an extracted field from the search into the Alert forwarded to an up-stream system.

Is this possible?

Best regards
Mathew

[jtrucks]

You can do this in two ways:

First, email the alert sending the results of the alert (it's just a setting in the web form).

Second, have the alert run a script on the Splunk server that then parses the results file (the location of which is found in the environment variable SPLUNK_ARG_8 the script (in whatever language) can access). After pull out only the data you want, have the script send mail, run processes, or do whatever else you need to parse it.

Look for more variable info at http://docs.splunk.com/Documentation/Splunk/6.0/Alert/Configuringscriptedalerts