Hello
I am trying to assign certain incident to an owner based on the results of a search. Is this possible? If not, is it possible to parse the value to a tag value?
Thanks
That should be possible when you put
$result.field_from_your_search$
in the "Owner" field of the alert action settings, so something like this:
Note: If there are multiple results, Splunk uses the value from the first row.
Thanks
works great.