Hi All,
In ES or in Splunk in general , How to return field value in double quotes ? We have the below setting for "Drill Down Name" which displays the Policy Name when alert is triggered. I did like the Policy Name to be enclosed in double quotes when it displays in the alert though. Any suggestions ?
Should i try this ?
\"$policy_name$\"
Try token filters
$policy_name|s$
https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters
Try token filters
$policy_name|s$
https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters