Splunk Search

How to return "Specific text" in the subject of an alert if regex matches any field/value from the results?

Meena27
Explorer

Hi,

I am trying to work to get "Specific text" in the subject of an alert using regex if possible.

Here it goes,

There are IDS alerts from MAC machines and windows machines in our environment. I want Splunk to return the search subject with MAC if regex matches any field/value from the results.

Any suggestions?

Tags (3)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

Since splunk 6.1 If you create a field with this value in your results, you can customize the alert format (and add the field with $result.fieldname$ in the email subject)
see http://docs.splunk.com/Documentation/Splunk/6.2.0/Alert/Setupalertactions

View solution in original post

yannK
Splunk Employee
Splunk Employee

Since splunk 6.1 If you create a field with this value in your results, you can customize the alert format (and add the field with $result.fieldname$ in the email subject)
see http://docs.splunk.com/Documentation/Splunk/6.2.0/Alert/Setupalertactions

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!