Alert Manager: How to assign a certain incident to an owner based on the results of a search?

[buckiboy]

Hello

I am trying to assign certain incident to an owner based on the results of a search. Is this possible? If not, is it possible to parse the value to a tag value?

Thanks

[Simon · Accepted solution]

That should be possible when you put

$result.field_from_your_search$

in the "Owner" field of the alert action settings, so something like this:

Note: If there are multiple results, Splunk uses the value from the first row.

[buckiboy]

Thanks

works great.