Alerting

Can we set up conditional alerting to have an alert sent to a certain email based on the search result?

rgoyal1010
New Member

I have logs from autosys (job scheduler) parsed into Splunk. It alerts me if it finds keyword INACTIVE in any of the events based on which I am able to extract the jobname. Is it possible for me to determine the alert subscription based on the output of this jobname?

0 Karma
1 Solution

ryanoconnor
Builder

If you want to do it all in one search, it may not be as straight forward but it's definitely possible.

You'll probably have to use some conditionals and the sendemail command:

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Sendemail

A sample search is below. Obviously you'd have to fit it to your desired output and probably play with it a little bit to get it right.

... | eval email_list = case(X,"jessica@company.com", Y, "joe@company.com,jessica@company.com") |map search="| sendemail to=$email_list$"

View solution in original post

ryanoconnor
Builder

If you want to do it all in one search, it may not be as straight forward but it's definitely possible.

You'll probably have to use some conditionals and the sendemail command:

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Sendemail

A sample search is below. Obviously you'd have to fit it to your desired output and probably play with it a little bit to get it right.

... | eval email_list = case(X,"jessica@company.com", Y, "joe@company.com,jessica@company.com") |map search="| sendemail to=$email_list$"

rgoyal1010
New Member

Will try this out and update if it works.

0 Karma

ryanoconnor
Builder

Are you looking for the search schedule to be based on the job name? Or would it suffice to have a search running regularly and have it alert you on certain intervals based on the job name?

0 Karma

rgoyal1010
New Member

I am able to run search at regular intervals and send alert. What I want is that based on the output of my search result can I determine which email alias would be alerted ?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...