https://community.splunk.com/t5/Alerting/Help-with-alert-conditional-destination/m-p/593791#M13755 <P>Hello!</P> <P>&nbsp;</P> <P>I have a search table that matches some values and users, like this:</P> <TABLE border="1" width="100%"> <TBODY> <TR> <TD width="50%">is_old_OS_version</TD> <TD width="50%">username</TD> </TR> <TR> <TD width="50%">true</TD> <TD width="50%">Bob</TD> </TR> <TR> <TD width="50%">false</TD> <TD width="50%">Marie</TD> </TR> <TR> <TD>true</TD> <TD>Alice</TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> <P>I want to send alerts to slack only to Bob and Alice and not to Marie. I know that I need a slack application and I have already made it.<BR />But how to integrate splunk with this application and chose only to mention the persons I need.<BR /><BR />Basically I have 2 strategies here:</P> <P>1. Send to some channel and mention person I need with&nbsp;@ (not the best option, because I will mention lot's of persons with old software in one place)<BR />2. Send directly to the person</P> <P>There are multiple splunk applications that helps integrate with slack, but as I see, I can only choose one channel ID for alert, but I need to dynamically change this ID or find another way.</P> Thu, 14 Apr 2022 17:03:19 GMT Radcriminal 2022-04-14T17:03:19Z https://community.splunk.com/t5/Alerting/Help-with-alert-conditional-destination/m-p/593791#M13755 <P>Hello!</P> <P>&nbsp;</P> <P>I have a search table that matches some values and users, like this:</P> <TABLE border="1" width="100%"> <TBODY> <TR> <TD width="50%">is_old_OS_version</TD> <TD width="50%">username</TD> </TR> <TR> <TD width="50%">true</TD> <TD width="50%">Bob</TD> </TR> <TR> <TD width="50%">false</TD> <TD width="50%">Marie</TD> </TR> <TR> <TD>true</TD> <TD>Alice</TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> <P>I want to send alerts to slack only to Bob and Alice and not to Marie. I know that I need a slack application and I have already made it.<BR />But how to integrate splunk with this application and chose only to mention the persons I need.<BR /><BR />Basically I have 2 strategies here:</P> <P>1. Send to some channel and mention person I need with&nbsp;@ (not the best option, because I will mention lot's of persons with old software in one place)<BR />2. Send directly to the person</P> <P>There are multiple splunk applications that helps integrate with slack, but as I see, I can only choose one channel ID for alert, but I need to dynamically change this ID or find another way.</P> Thu, 14 Apr 2022 17:03:19 GMT https://community.splunk.com/t5/Alerting/Help-with-alert-conditional-destination/m-p/593791#M13755 Radcriminal 2022-04-14T17:03:19Z