https://community.splunk.com/t5/Reporting/6-1-Ability-to-use-field-value-as-email-destination-for/m-p/113906#M2580 <P>Is there any ability built in to splunk to use a field from a returned search, as a dynamic field in a scheduled search? I'm trying to use a "to" field as the destination (to) field in a schedule email alert.</P> Wed, 08 Jul 2015 22:00:56 GMT hortonew 2015-07-08T22:00:56Z https://community.splunk.com/t5/Reporting/6-1-Ability-to-use-field-value-as-email-destination-for/m-p/113906#M2580 <P>Is there any ability built in to splunk to use a field from a returned search, as a dynamic field in a scheduled search? I'm trying to use a "to" field as the destination (to) field in a schedule email alert.</P> Wed, 08 Jul 2015 22:00:56 GMT https://community.splunk.com/t5/Reporting/6-1-Ability-to-use-field-value-as-email-destination-for/m-p/113906#M2580 hortonew 2015-07-08T22:00:56Z https://community.splunk.com/t5/Reporting/6-1-Ability-to-use-field-value-as-email-destination-for/m-p/113907#M2581 <P>The sendresults app/command should help you out here. It looks for a field named <CODE>email_to</CODE> but a <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/rename">rename</A> can work wonders: <A href="https://splunkbase.splunk.com/app/1794/">https://splunkbase.splunk.com/app/1794/</A></P> Wed, 08 Jul 2015 22:17:11 GMT https://community.splunk.com/t5/Reporting/6-1-Ability-to-use-field-value-as-email-destination-for/m-p/113907#M2581 acharlieh 2015-07-08T22:17:11Z https://community.splunk.com/t5/Reporting/6-1-Ability-to-use-field-value-as-email-destination-for/m-p/113908#M2582 <P>Thanks - didn't think to look at prebuilt apps. I'll dive in and see what it's all about. Appreciate it.</P> Wed, 08 Jul 2015 22:18:46 GMT https://community.splunk.com/t5/Reporting/6-1-Ability-to-use-field-value-as-email-destination-for/m-p/113908#M2582 hortonew 2015-07-08T22:18:46Z https://community.splunk.com/t5/Reporting/6-1-Ability-to-use-field-value-as-email-destination-for/m-p/113909#M2583 <P>Works like a charm - definitely the way to go. Thanks again.</P> Wed, 08 Jul 2015 22:31:57 GMT https://community.splunk.com/t5/Reporting/6-1-Ability-to-use-field-value-as-email-destination-for/m-p/113909#M2583 hortonew 2015-07-08T22:31:57Z https://community.splunk.com/t5/Reporting/6-1-Ability-to-use-field-value-as-email-destination-for/m-p/113910#M2584 <P>No need for any App - just use <CODE>$result.field$</CODE> in your <CODE>to</CODE>-field.</P> <P>6.1-specific docs: <A href="http://docs.splunk.com/Documentation/Splunk/6.1/Alert/Setupalertactions#Use_tokens_in_email_notifications">http://docs.splunk.com/Documentation/Splunk/6.1/Alert/Setupalertactions#Use_tokens_in_email_notifications</A></P> Wed, 08 Jul 2015 23:47:10 GMT https://community.splunk.com/t5/Reporting/6-1-Ability-to-use-field-value-as-email-destination-for/m-p/113910#M2584 martin_mueller 2015-07-08T23:47:10Z https://community.splunk.com/t5/Reporting/6-1-Ability-to-use-field-value-as-email-destination-for/m-p/113911#M2585 <P>Huh, nice. I'll try that out tomorrow as well. Thanks!</P> Thu, 09 Jul 2015 02:06:44 GMT https://community.splunk.com/t5/Reporting/6-1-Ability-to-use-field-value-as-email-destination-for/m-p/113911#M2585 hortonew 2015-07-09T02:06:44Z