Can we set up conditional alerting to have an alert sent to a certain email based on the search result?

[rgoyal1010]

I have logs from autosys (job scheduler) parsed into Splunk. It alerts me if it finds keyword INACTIVE in any of the events based on which I am able to extract the jobname. Is it possible for me to determine the alert subscription based on the output of this jobname?

[ryanoconnor · Accepted solution]

If you want to do it all in one search, it may not be as straight forward but it's definitely possible.

You'll probably have to use some conditionals and the sendemail command:

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Sendemail

A sample search is below. Obviously you'd have to fit it to your desired output and probably play with it a little bit to get it right.

... | eval email_list = case(X,"jessica@company.com", Y, "joe@company.com,jessica@company.com") |map search="| sendemail to=$email_list$"

[rgoyal1010]

Will try this out and update if it works.

[ryanoconnor]

Are you looking for the search schedule to be based on the job name? Or would it suffice to have a search running regularly and have it alert you on certain intervals based on the job name?

[rgoyal1010]

I am able to run search at regular intervals and send alert. What I want is that based on the output of my search result can I determine which email alias would be alerted ?