alert lookup file with alert trigger condition tokens

[arun_kant_sharm]

Hi Experts,

I want to store alert search result and the following token in Lookup file

app = $app$
description = $description$

name = $name$

owner = $owner$

results_link = $results_link$

search = $search$

trigger_date = $trigger_date$

trigger_timeHMS = $trigger_timeHMS$

trigger_time = $trigger_time$

severity= $alert.severity$

[begleyj1]

Have you looked into the outputlookup command?

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Outputlookup