I have a table that I am returning from the search below:
host=sre*
| search "[*._reprovision()] - [WARNING]" | dedup CORP_ACCT_NBR
| rex field=_raw "(?<BROKEN_ACCOUNT>Failed to Provision)"
| table CORP_ACCT_NBR , BROKEN_ACCOUNT, _raw, _time
And I am using the JIRA Service desk and I wanted to know if there were any values similar to $name$ that allows me to send my table inline when the extension doesn't offer the option.
Also, is there a reference of all available variables similar to $name$ that can be referenced somewhere? I cannot seem to find a list of these anywhere.
Strings enclosed within '$' are called 'tokens'. Fields can be used as tokens and there are built-in tokens, as well. See https://docs.splunk.com/Documentation/Splunk/8.1.0/Viz/tokens