Hi all,
I created a correlation search in SPlunk ES and added a Notable Event in the Adaptative Response Actions.
I'd like to include in the notable some information from the correlation search results, such as : orig_host, ip, and some other custom fields.
I then added a fiew variables in the title of the created Notable. Something like "the user $custom_field_1$ just connected to the account of the user $custom_field_2$, from the computer $orig_host$ that belongs to $orig_host_owner$.
custom_field_1 and $custom_field_2 variables work and return the right values.
orig_host, orig_host_owner don't and return the strings $orig_host$ and $orig_host_owner$.
I'm a bit confused.
Does anybody have had this before ?
Thanks for your kind help !