https://community.splunk.com/t5/Splunk-Search/A-loop-to-mail-individual-events-to-different-addresses/m-p/115535#M30626 <P>This functionality doesn't exist.<BR /> But you can create your own scripted alert that will create the emails after parsing the results.</P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/6.0/Alert/Configuringscriptedalerts">http://docs.splunk.com/Documentation/Splunk/6.0/Alert/Configuringscriptedalerts</A></P> Sat, 26 Oct 2013 00:43:13 GMT yannK 2013-10-26T00:43:13Z https://community.splunk.com/t5/Splunk-Search/A-loop-to-mail-individual-events-to-different-addresses/m-p/115534#M30625 <P>I have a simple search similar to this</P> <PRE><CODE>host=ccirc.example.com | table email malware | sort email | uniq </CODE></PRE> <P>which gives me results like this</P> <PRE><CODE>freddy@example.com zeroconf jimbob@example.com conficker jamesdean@example.com citadel marthastewart@example.com zeus </CODE></PRE> <P>Is it possible for me to iterate through each line and send a boilerplate email to the address in the fist field, basically saying "you are infected with $virus"?</P> <P>I should also note that the source file for this search is generated by a script once a day, so you don't see individual lines coming in 'real time.'</P> <P>Any insights are much appreciated!</P> Fri, 25 Oct 2013 15:42:55 GMT https://community.splunk.com/t5/Splunk-Search/A-loop-to-mail-individual-events-to-different-addresses/m-p/115534#M30625 decoherence 2013-10-25T15:42:55Z https://community.splunk.com/t5/Splunk-Search/A-loop-to-mail-individual-events-to-different-addresses/m-p/115535#M30626 <P>This functionality doesn't exist.<BR /> But you can create your own scripted alert that will create the emails after parsing the results.</P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/6.0/Alert/Configuringscriptedalerts">http://docs.splunk.com/Documentation/Splunk/6.0/Alert/Configuringscriptedalerts</A></P> Sat, 26 Oct 2013 00:43:13 GMT https://community.splunk.com/t5/Splunk-Search/A-loop-to-mail-individual-events-to-different-addresses/m-p/115535#M30626 yannK 2013-10-26T00:43:13Z https://community.splunk.com/t5/Splunk-Search/A-loop-to-mail-individual-events-to-different-addresses/m-p/115536#M30627 <P>by the way nice reference to the quantic transient state.<BR /> <A href="http://en.wikipedia.org/wiki/Quantum_decoherence">http://en.wikipedia.org/wiki/Quantum_decoherence</A></P> Sat, 26 Oct 2013 00:44:15 GMT https://community.splunk.com/t5/Splunk-Search/A-loop-to-mail-individual-events-to-different-addresses/m-p/115536#M30627 yannK 2013-10-26T00:44:15Z https://community.splunk.com/t5/Splunk-Search/A-loop-to-mail-individual-events-to-different-addresses/m-p/115537#M30628 <P>Thanks for pointing me in the right direction!</P> Tue, 29 Oct 2013 15:21:15 GMT https://community.splunk.com/t5/Splunk-Search/A-loop-to-mail-individual-events-to-different-addresses/m-p/115537#M30628 decoherence 2013-10-29T15:21:15Z