Alerting

Can we set up conditional alerting to have an alert sent to a certain email based on the search result?

rgoyal1010
New Member

I have logs from autosys (job scheduler) parsed into Splunk. It alerts me if it finds keyword INACTIVE in any of the events based on which I am able to extract the jobname. Is it possible for me to determine the alert subscription based on the output of this jobname?

0 Karma
1 Solution

ryanoconnor
Builder

If you want to do it all in one search, it may not be as straight forward but it's definitely possible.

You'll probably have to use some conditionals and the sendemail command:

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Sendemail

A sample search is below. Obviously you'd have to fit it to your desired output and probably play with it a little bit to get it right.

... | eval email_list = case(X,"jessica@company.com", Y, "joe@company.com,jessica@company.com") |map search="| sendemail to=$email_list$"

View solution in original post

ryanoconnor
Builder

If you want to do it all in one search, it may not be as straight forward but it's definitely possible.

You'll probably have to use some conditionals and the sendemail command:

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Sendemail

A sample search is below. Obviously you'd have to fit it to your desired output and probably play with it a little bit to get it right.

... | eval email_list = case(X,"jessica@company.com", Y, "joe@company.com,jessica@company.com") |map search="| sendemail to=$email_list$"

rgoyal1010
New Member

Will try this out and update if it works.

0 Karma

ryanoconnor
Builder

Are you looking for the search schedule to be based on the job name? Or would it suffice to have a search running regularly and have it alert you on certain intervals based on the job name?

0 Karma

rgoyal1010
New Member

I am able to run search at regular intervals and send alert. What I want is that based on the output of my search result can I determine which email alias would be alerted ?

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...