Splunk ITSI

Splunk IT Service Intelligence : How can I pass the field value to comments (in Action rules) for Notable Event Grouping

harshal_chakran
Builder

Hi,
I am grouping the Notable events on certain conditions and set the action rules for them.
In Alert Actions, we have a section "add a comment". I want this comment to be dynamic based on field value passed.
Currently the static one works like : ISSUE from SERVER got RESOLVED

I want this ISSUE field to take dynamic values. I have tried %ISSUE% , $result.ISSUE$ and $ISSUE$, but no luck.

Labels (1)
0 Karma
1 Solution

skadadi_splunk
Splunk Employee
Splunk Employee

Hi Harshal,
We dont have that capability yet in ITSI. It sounds like a very valid use case and I can follow up with the Product Owners to see when we could get this feature.

View solution in original post

0 Karma

skadadi_splunk
Splunk Employee
Splunk Employee

Hi Harshal,
We dont have that capability yet in ITSI. It sounds like a very valid use case and I can follow up with the Product Owners to see when we could get this feature.

0 Karma

harshal_chakran
Builder

Thanks skadadi,
Eagerly waiting for this feature.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...