Alerting

How to combine two tokens (with NO Space) in an alert email?

adamfiore
Explorer

I have an email alert that I've configured that I would like to include two tokens without a space in the body of the email.

The two fields are:

&nbsp - member_nt_domain = URT\
&nbsp - member = jsmith

So, I would like the output in the email formatted like this: URT\jsmith. The reason that I can't have the space is that the domain token includes the backslash - otherwise adding "\" in between the two tokens would produce the desired result.

I have tried the following, but none seem to work. (I've included the result that each produces in the section after the -->)

$result.member_nt_domain result.member$  -->  *blank*
$result.member_nt_domain$ $result.member$  -->  URT\ jsmith
$result.member_nt_domain$$result.member$  -->  $result.member_nt_domain$result.member$
$result.member_nt_domain$result.member$  -->  URT\result.member$

Thanks for the help.

0 Karma
1 Solution

kmaron
Motivator
| eval domainmember = member_nt_domain.member

then use the token: $result.domainmember$

View solution in original post

kmaron
Motivator
| eval domainmember = member_nt_domain.member

then use the token: $result.domainmember$

adamfiore
Explorer

Perfect, thanks!

0 Karma

kmaron
Motivator

could you do an eval in the actual search to make a new token that is exactly what you want?

s2_splunk
Splunk Employee
Splunk Employee

Haven't tried this with the tokens themselves, but you could use an eval in your alerting search to create a new field with the combined/concatenated value and us that as the token instead.

adamfiore
Explorer

Thanks for the suggestion. I'm just getting start with Splunk - any chance you could provide an example of how to do this. Here is how the search is currently written. Appreciate it.

EventCode=4732 Group_Name=Administrators Group_Domain=Builtin | fields *

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

See @kmaron's answer below. You can probably remove the "| fields *"

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...