topic Re: Change alert target email based on data in Alerting

Change alert target email based on data

smileyge — Mon, 10 Mar 2014 19:17:01 GMT

I would like to set up an alert that sends an email to an email address contained in the data that the alert triggers on. For example, let's say I have a data set that contains emails, and I want to count those and send those email addresses their counts every week or on some other timing. Can I somehow pipe the email field from the data that generated the alert into the email that is sent, instead of specifying the alert emails should always go to a static address I specify at the time I configure the alert?

Re: Change alert target email based on data

martin_mueller — Mon, 10 Mar 2014 21:03:37 GMT

Splunk's alert emails can't do that out of the box. However, you can modify a copy of the sendemail command to roll your own email script that reads receivers from the data rather than from the alert config.

Re: Change alert target email based on data

martin_mueller — Mon, 02 Jun 2014 13:20:35 GMT

Update: Splunk 6.1 comes with this very feature 🙂