https://community.splunk.com/t5/Alerting/Send-Email-Alert-by-result-query/m-p/392629#M6901 <P>Try this:</P> <PRE><CODE>sourcetype=error | stats count by email | sendmail to=$result.email$ </CODE></PRE> <P>OR </P> <PRE><CODE> sourcetype=error | stats count by email | sendmail to=$email$ </CODE></PRE> Mon, 07 Jan 2019 07:45:24 GMT p_gurav 2019-01-07T07:45:24Z https://community.splunk.com/t5/Alerting/Send-Email-Alert-by-result-query/m-p/392628#M6900 <P>Hi ALL!<BR /> sourcetye=error | stats count by email | sendmail to=....</P> <P>I want the receiver in "sendmail" is the result of query "stats count by email"<BR /> For example:<BR /> If we have 3 emails from the "stats count by email"<BR /> Then the query "sendmail" will send email to the 3 above emails.</P> <P>Thanks in advance!</P> Mon, 07 Jan 2019 07:33:27 GMT https://community.splunk.com/t5/Alerting/Send-Email-Alert-by-result-query/m-p/392628#M6900 vumanhtai 2019-01-07T07:33:27Z https://community.splunk.com/t5/Alerting/Send-Email-Alert-by-result-query/m-p/392629#M6901 <P>Try this:</P> <PRE><CODE>sourcetype=error | stats count by email | sendmail to=$result.email$ </CODE></PRE> <P>OR </P> <PRE><CODE> sourcetype=error | stats count by email | sendmail to=$email$ </CODE></PRE> Mon, 07 Jan 2019 07:45:24 GMT https://community.splunk.com/t5/Alerting/Send-Email-Alert-by-result-query/m-p/392629#M6901 p_gurav 2019-01-07T07:45:24Z https://community.splunk.com/t5/Alerting/Send-Email-Alert-by-result-query/m-p/392630#M6902 <P>Hi vumanhtai,</P> <P>You may want to take a look at this app which allows for more dynamic alerting based on results: <A href="https://splunkbase.splunk.com/app/1794/#/details">https://splunkbase.splunk.com/app/1794/#/details</A>.</P> Mon, 07 Jan 2019 15:22:38 GMT https://community.splunk.com/t5/Alerting/Send-Email-Alert-by-result-query/m-p/392630#M6902 mdsnmss 2019-01-07T15:22:38Z