I am trying to assign certain incident to an owner based on the results of a search. Is this possible? If not, is it possible to parse the value to a tag value?
That should be possible when you put
in the "Owner" field of the alert action settings, so something like this:
Note: If there are multiple results, Splunk uses the value from the first row.
View solution in original post