Add entry data to an alert

[mwcentracomm]

I am using the search below

| metadata type=hosts | where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen

I would like to add a field populated by somename that ends in "srx"

Jan 4 13:07:57 1.1.1.1 1 2024-01-04T13:07:57.085-05:00 5995-somename-srx rpd 2188 JTASK_SIGNAL_INFO [[email protected] message-name="INFO Signal Info: Signal Number = " signal-number="1" name=" Consumed Count = " data-1="3"]

[richgalloway]

Use the eval command to add a field to your results.

| metadata type=hosts 
| where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") 
| fields + host lastSeen
| eval newField="srx"

[mwcentracomm]

Sorry, I did not completely explain, - I would like it to return the full name ending in srx.

[richgalloway]

Only the fields provided by the metadata command can be displayed unless you add other commands that search indexes for names ending with "srx".  If the desired field *is* returned by metadata then include it in the fields command then use where or search to filter the desired values.

| metadata type=hosts 
| where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") 
| fields + host lastSeen
| search host="*srx"