Alerting

Alert Sending Email based on Value of a field

ifeldshteyn
Communicator

I have saved a field in the result that is called Email. If in my search that field is present I want to send an email to that email. Is that possible to do in an alert?

So if in the results the field Email equals bob@bobsworld.com, the search will send an email to this bob with a certain message.

Also if would be great if you could send to more than one user based on how many Fields are there.

So if there are two results in the search, one Field equals nancy@bobsworld.com and the other bob@bobsworld.com then an email s would be sent to each one of them.

Complicated? Or is there a possible solution?

If not, is it possible to start a script with the inputs of the values of the fields and I will do the sending in the script?

Thanks.

Tags (2)
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

Short answer: no, Splunk cannot do that by default. However you should be able to write a custom search command that does what you're looking for. Alternatively you can also call and external script that does the work using the script search command script

View solution in original post

Ledion_Bitincka
Splunk Employee
Splunk Employee

Short answer: no, Splunk cannot do that by default. However you should be able to write a custom search command that does what you're looking for. Alternatively you can also call and external script that does the work using the script search command script

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...