topic Re: How do you dynamically send an email notification to multiple recipients based on the search output? in Alerting

How do you dynamically send an email notification to multiple recipients based on the search output?

isamrat — Wed, 31 Oct 2018 19:09:01 GMT

I have one alert stanza in my savedsearches.conf. Now, I want to dynamically send email notifications to the consumers based on the output of the result query. Suppose the alert query will give me the below output table after one run:

Now, based on the consumer names, I should be getting email alerts to different **email Ids** with different email subjects dynamically. So that I don't need to set up multiple alert stanzas in savedsearches.conf for different email recipients.

Please let me know how I can implement this.

Re: How do you dynamically send an email notification to multiple recipients based on the search output?

cmerriman — Wed, 31 Oct 2018 19:18:10 GMT

have you seen this answer?

https://answers.splunk.com/answers/213340/how-to-get-splunk-sendemail-command-to-send-multip.html

I think this might be an approach that will work for your ask.

This documentation might also help. If there is a way you can join email addresses to the consumer, you could use $result.email$ in the To field of the alert.
http://docs.splunk.com/Documentation/Splunk/7.2.0/Alert/Emailnotification#Example_-_Send_email_to_different_recipients_based_on_search_results

Re: How do you dynamically send an email notification to multiple recipients based on the search output?

isamrat — Wed, 31 Oct 2018 19:45:41 GMT

Thanks for your insights. But I would rather prefer to have some solution based on scripting. Let me know if you have any solution based on scripting.

Re: How do you dynamically send an email notification to multiple recipients based on the search output?

gjanders — Wed, 31 Oct 2018 22:28:15 GMT

sendresults exists for this use case

Re: How do you dynamically send an email notification to multiple recipients based on the search output?

chandrasekharko — Thu, 01 Nov 2018 20:31:13 GMT

Install and use sendresults app from the splunkbase to do so.