Splunk Search

How to get the row text from inputlookup in a variable for email alert



I am using a CSV file to catch some alerts, and that part works fine, I catch all my alerts.

index="main"  [inputlookup linux_alerts.csv | table AlertMsg | rename AlertMsg as search | format ]

The file goes like this:
Some alert text 1
Some alert text 2
Some other stuff

What I would like is when one of these row is triggered to have it in a variable for the body of the email. Something like $result.AlertMsg$


0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...