Splunk Search

Splunk 'mail merge', how could I substitute 'named text' in a field with values from other fields

splunked38
Communicator

Hi,

In short, just wondering if anyone has used Splunk for 'mail merging'

I have a dynamically generated field containing substitution text. For example:

Hello {user_name}, my name is {computer_name}
Hey {computer_name}, you have {seconds} seconds to comply

Each event contains the relevant substituted text eg:

<time>, user_name=bob, computer_name=mary, message="Hello {user_name}, my name is {computer_name}"
<time>, computer_name=jack, seconds=10, message="Hey {computer_name}, you have {seconds} seconds to comply"

For completeness, this is what the output (messages) should look like:

Hello bob, my name is mary
Hey jack, you have 10 seconds to comply

Due to the number of permutations for messages, this is not really appropriate:
https://answers.splunk.com/answers/543951/replace-substitution-placeholders-in-a-field.html

Any suggestions?

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...