Splunk ITSI

Splunk IT Service Intelligence : How can I pass the field value to comments (in Action rules) for Notable Event Grouping

harshal_chakran
Builder

Hi,
I am grouping the Notable events on certain conditions and set the action rules for them.
In Alert Actions, we have a section "add a comment". I want this comment to be dynamic based on field value passed.
Currently the static one works like : ISSUE from SERVER got RESOLVED

I want this ISSUE field to take dynamic values. I have tried %ISSUE% , $result.ISSUE$ and $ISSUE$, but no luck.

Labels (1)
0 Karma
1 Solution

skadadi_splunk
Splunk Employee
Splunk Employee

Hi Harshal,
We dont have that capability yet in ITSI. It sounds like a very valid use case and I can follow up with the Product Owners to see when we could get this feature.

View solution in original post

0 Karma

skadadi_splunk
Splunk Employee
Splunk Employee

Hi Harshal,
We dont have that capability yet in ITSI. It sounds like a very valid use case and I can follow up with the Product Owners to see when we could get this feature.

0 Karma

harshal_chakran
Builder

Thanks skadadi,
Eagerly waiting for this feature.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...