Alerting

How can I get an alert Trigger action, to log the data that triggers it as the log event > event text?

jjlandauer
New Member

I have an alert based on application logs of a web application. This alert fires based on data generated by user activity. For example, if a user is using the application from more than one IP an alert is triggered. I would like to use the alert action log event to log the alert and the data that triggered it. If I add $name$ to the event text, the name of the alert is logged. But how can I get the data that triggered the alert, the 1 username and 2 ip address, to be logged under the alert?

Tags (1)
0 Karma
1 Solution

HiroshiSatoh
Champion

In the case of this alert

(your search)|stats dc(ip) as count,values(ip) as ip by user|where count >1

You can embed ” $result.ip$”

View solution in original post

0 Karma

HiroshiSatoh
Champion

In the case of this alert

(your search)|stats dc(ip) as count,values(ip) as ip by user|where count >1

You can embed ” $result.ip$”

0 Karma

jjlandauer
New Member

Thank you!!! This worked perfectly!! How did you know this though? Is there a place this is documented? I searched!!!

0 Karma

HiroshiSatoh
Champion

There is a document about tokens. The search statement is an experience.
Please enjoy Splunk.

https://docs.splunk.com/Documentation/Splunk/7.2.5/Alert/EmailNotificationTokens

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...