topic Re: How to send alerts to multiple emails based on lookup table match on host owners? in Splunk Search

How to send alerts to multiple emails based on lookup table match on host owners?

tmaltizo — Mon, 19 Dec 2016 21:48:02 GMT

We currently have a lookup table with hosts and their respective owner email.

host ; host owner email
ABCD1234 ; ABCD1234Dist@emailadd.com
XYZ123 ; XYZ123Dist@emailadd.com

We'd like to trigger email alerts if any host becomes non-compliant by the 6th day to warn the owners to remediate the issues before they get on the 7th-day non-compliant report. Given, that the two sample hosts above meet this condition, how would we incorporate this logic into the email alerting, if not through the alert wizard?

Thanks for any help!
Trista

Re: How to send alerts to multiple emails based on lookup table match on host owners?

jimodonald — Mon, 19 Dec 2016 22:03:30 GMT

I think the "sendemail" command is what you're looking for.

https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Sendemail

Re: How to send alerts to multiple emails based on lookup table match on host owners?

woodcock — Mon, 19 Dec 2016 22:14:11 GMT

You will need these commands:

stats, map, and sendemail

If you give more logic and example searches, then people will give more specific answers.