Can Splunk send alerts in IODEF format?

[b3hnam]

Hello friends.

I had a question for you

I wanted to see how I can convert an alert in Splank to IODEF format?

[isoutamo]

Hi

after you have run SPL which generate the alert you must add the end for those needed fields like 

``` Your base alert code here ```
| eval IncidentID = <your incident id based on some template format>
| eval AlternativeID = <result from some sub search etc. if you have those>
| eval <all other fields what you need to add our IODEF "object"/message>
....
< send it where and how it should do in your environment e.g. email, some external command etc.> 

r. Ismo