Hi
I there any way to dynamically fill in the part in red? Assuming the alert is running from the Searched.
The idea is if you re-install on a new Splunk install, you don't want to have to find and replace all the