Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to get the row text from inputlokkup in a variable for email alert

$
0
0
HI! I am using a csv file to catch some alerts, and that part works fine, I catch all my alerts. index="main" [inputlookup linux_alerts.csv | table AlertMsg | rename AlertMsg as search | format ] The file goes like this: **AlertMsg Some alert text 1 Some alert text 2 Some other stuff** What I would like is when one of these row is triggered to have it in a variable for the body of the email. Something like **$result.AlertMsg$** Thanks

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>