How can I get an alert Trigger action, to log the data that triggers it as the log event > event text?

[jjlandauer]

I have an alert based on application logs of a web application. This alert fires based on data generated by user activity. For example, if a user is using the application from more than one IP an alert is triggered. I would like to use the alert action log event to log the alert and the data that triggered it. If I add $name$ to the event text, the name of the alert is logged. But how can I get the data that triggered the alert, the 1 username and 2 ip address, to be logged under the alert?

[HiroshiSatoh · Accepted solution]

In the case of this alert

(your search)|stats dc(ip) as count,values(ip) as ip by user|where count >1

You can embed ” $result.ip$”

[jjlandauer]

Thank you!!! This worked perfectly!! How did you know this though? Is there a place this is documented? I searched!!!

[HiroshiSatoh]

There is a document about tokens. The search statement is an experience.
Please enjoy Splunk.

https://docs.splunk.com/Documentation/Splunk/7.2.5/Alert/EmailNotificationTokens