About tr_newman

tr_newman · ‎10-20-2023

We have a solution using the collect command, but the team we're engineering this for does not want the collect command in the alert because they often times use the search link to do investigations and will generate additional collections (which kick off tickets). So we're thinking the log event alert action might be better to use, but you have to manually define each field that you want. Trying to see if we can just pull all the fields of the event into the Event Text.

tr_newman · ‎10-19-2023

We are utilizing the Log Event Trigger Action for an alert and we'd essentially like to duplicate the event that's found into another index. There is some renaming that happens in the alert, so pulling the_raw wouldn't include the renamed fields correct? If _raw is the way to go, what is the token for this? $result._raw$?

tr_newman · ‎10-17-2023

I figured it out, the search link is saved under the search_link value.

tr_newman · ‎10-17-2023

You're awesome. But now I have a conundrum. The analysts do not like the fact that we added the collection at the end of the alert because now when they go to the splunk link they have accidentally kicked off more tickets because they didn't remove the collection before making modifications to the search to investigate an alert. Now I'm trying to figure out how I can collect, and rename fields, while also not impacting their search 😕

tr_newman · ‎09-27-2023

I have an alert that fires and while generating the alert, uses appendpipe to collect fields and generate an event in another index for collection by a third party tool. Is there a way to add the View Results link to the event that's generated so that it can map it in our third party tool to link the analysts back to the original alert?

tr_newman · ‎09-21-2023

So to make sure I understand what's happening, we are modifying information in a separate summary, then using table to reveal that information, collecting that info. Once we break out of the appendpip, we then display the original fields. If you don't mind me asking, what is the where false() for?

tr_newman · ‎09-20-2023

We currently have an alert set up that generates a ticket in our ticketing platform. We are currently moving to a new ticketing platform and have utilized collect to collect the event and put it in a new index for that ticketing platform to pull data from. Is there a way to rename fields of the event that is collected, but not change the field names for the current alert? We have to have different field names for the new ticketing system to map correctly. My only idea right now is either duplicate the alert and have them run in parallel, or when the ticketing system queries splunk for new events, to have that query contain a search macro that does the renaming before the events are ingested,

Posts	7
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎08-31-2023

Online Status	Offline
Date Last Visited	‎03-11-2024 03:36 PM

How to pull all data using Log Event Trigger Actio...

Link to Alert Results to a Field?

How to have an Alert Generate A Secondary Event wi...

Re: How to pull all data using Log Event Trigger A...

How to pull all data using Log Event Trigger Actio...

Re: Link to Alert Results to a Field?

Re: Have Alert Generate A Secondary Event with Dif...

Link to Alert Results to a Field?

Re: Have Alert Generate A Secondary Event with Dif...

How to have an Alert Generate A Secondary Event wi...

Join the Conversation