Hi @TravisT , Can't help you with the Addon Builder, but 2 other options: 1. Use this App from Splunkbase. Should be ready-to-go. https://splunkbase.splunk.com/app/1546 2. Put your Curl command in a .sh script, or create a Python that does the same and use a Scripted input. The stdout of the script will be your indexed events in Splunk. BR Ralph ... View more

Hi @priya0709 , Well, there has to be something "unique" to identify them. Do they always  start with a capital "W"? Is there a min/max length of the string? Are the subjects where they appear always look the same. You gave 2 examples, are there more possible subjects where they appear? The following, simple RegEx would work if there are never no other words/strings that start with a capital "W" in the subject and if servername always has "W" as first character: | rex field=subject "(?<servername>W\S+)" You could make it more sensitive with adding words/characters that appear around the servername, if that is limited. Or you could specify a min and max length of the servername string. Hope it helps. BR Ralph -- Karma and/or Solution tagging appreciated. ... View more

Hi @priya0709 , That's what @isoutamo 's first command does. You can add the field if you like: | rex field=subject "(?<wholeInc>INC\d+)"   The second command was just to strip the pure number (without "INC) from the whole Incidend ID. BR Ralph   ... View more

Hi @priya0709 , Can you share an/some example(s) what the subject might look like? BR Ralph ... View more

Hi @sanjeevreddy , You need the Splunk Add-on for BMC Remedy https://splunkbase.splunk.com/app/3087/ And then follow the steps here https://docs.splunk.com/Documentation/AddOns/released/Remedy/Usecustomalertactions BR Ralph -- Karma and/or Solution tagging appreciated.   ... View more