How to send email alert where email is taken from the logs ?

haripriyasarve1 — Tue, 14 Jul 2020 11:10:26 GMT

Hi Everyone,

I have data like below,

Certificate1, expirydate-15/7/2020, a@gmail.com

Certificate2, expirydate-18/7/2020, b@gmail.com

I need to setup email alerts in such a way, when expiry date is today , need to send alert to that particular email id automatically.

I have around 1000 certificates, so if I do it manually, it takes so much time. Is there a way where we can automate this? Please help out.

Re: How to send email alert where email is taken from the logs ?

rnowitzki — Tue, 14 Jul 2020 13:37:53 GMT

Hi @haripriyasarve1,

You could create a field that includes the email from the search results and in the Alert settings add a token to reference that field in the "To" box like $result.fieldname$

https://docs.splunk.com/Documentation/Splunk/8.0.5/Alert/EmailNotificationTokens

Hope that helps

Ralph