I am currently in the process of creating an adaptive response that I want to be able to add some user input into a lookup. I have the functionality with dashboards/searches currently and would like to use the same searches within the adaptive response. The searches do not take long to run as they are mostly lookup-based. All I need to do is to pass the users input into the code, which I have, and then call those variables within a search, like a dashboard would do with $var$. I would rather do this than change the entire framework to be event based, and create events with the adaptive response. Is there any way of running a search in/with the adaptive response? ... View more

I found that someone else had asked this, but as it was asked in 2015, I thought I would ask as well. Correlation searches contain many different "Adaptive Response Actions", one such action is the "Send email" action. This action contains multiple fields to be filled in such as: To, Priority, Subject, Message, Include, and Type. The "Message" field will come pre filled. The "Message" field will display in the body of an email when triggered. Now the problem is that even if you were to change the "Message", the body of the email that is actually sent will not update. Splunk does save the new Message, so what you wrote will not be deleted, but it will not send with the email, as it does with Alerts. The reason this is an issue for me, is because I am trying to make getting to a search based off of info from the event easier. I planned on including something that would refer to the results and add it as a link in the email, ie https://splunksite.com/app/search/search?something | where $result.count$>x If there is another way to make this work aside from making an alert out of the correlation search and using an alert action, please let me know. I do not want to be running two searches for the exact same thing just so one can email correctly while the other makes Notable Events correctly. Thank you. ... View more