Alerting

The field could not be added to log event alert action

hoangpt
Explorer

 

I have a problem that needs everyone to help me. I am trying to create log from an alert.
Please tell me how to separate the relevant fields from the raw data and then map it to that alert log, e.g. src_ip, servity...
 

120039370_2762800517341353_7177177067103308761_o.jpg

Labels (1)
0 Karma
1 Solution

dave_null
Path Finder

In the Event textfield, you can structure your generated event however you like. To insert values from the alert, use this format: (for example if you want to put src_ip field from the alert into the generated field)

$result.src_ip$

E.g. you can put this in the event text box:

Alert log - src_ip: $result.src_ip$ , severity: $result.severity$

View solution in original post

dave_null
Path Finder

In the Event textfield, you can structure your generated event however you like. To insert values from the alert, use this format: (for example if you want to put src_ip field from the alert into the generated field)

$result.src_ip$

E.g. you can put this in the event text box:

Alert log - src_ip: $result.src_ip$ , severity: $result.severity$

hoangpt
Explorer

Thank you for solving my problem 😄

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The alert is triggered by a query. The first row of the results of the query are available to be used in the log message you create. Therefore, you need to include all the information you want to be in your log in the results of the query that triggers the alert.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...