Splunk Search

Extracting field data from alert to be emailed

New Member

I have an alert configured to automatically send an email upon a user account locking. I'm looking for the email to only include four fields: a specific event code (EventCode=4740), message (Message=A user account was locked out.), Caller Computer Name, and a timestamp of when the event occurred. How do I go about accomplishing this?

Thank you in advance.

0 Karma


can you share your current search? I mean, it should just be a matter of tabling those fields...and possibly creating them first if needed.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!