Alerting

Can we set up conditional alerting to have an alert sent to a certain email based on the search result?

New Member

I have logs from autosys (job scheduler) parsed into Splunk. It alerts me if it finds keyword INACTIVE in any of the events based on which I am able to extract the jobname. Is it possible for me to determine the alert subscription based on the output of this jobname?

0 Karma
1 Solution

Builder

If you want to do it all in one search, it may not be as straight forward but it's definitely possible.

You'll probably have to use some conditionals and the sendemail command:

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Sendemail

A sample search is below. Obviously you'd have to fit it to your desired output and probably play with it a little bit to get it right.

... | eval email_list = case(X,"jessica@company.com", Y, "joe@company.com,jessica@company.com") |map search="| sendemail to=$email_list$"

View solution in original post

Builder

If you want to do it all in one search, it may not be as straight forward but it's definitely possible.

You'll probably have to use some conditionals and the sendemail command:

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Sendemail

A sample search is below. Obviously you'd have to fit it to your desired output and probably play with it a little bit to get it right.

... | eval email_list = case(X,"jessica@company.com", Y, "joe@company.com,jessica@company.com") |map search="| sendemail to=$email_list$"

View solution in original post

New Member

Will try this out and update if it works.

0 Karma

Builder

Are you looking for the search schedule to be based on the job name? Or would it suffice to have a search running regularly and have it alert you on certain intervals based on the job name?

0 Karma

New Member

I am able to run search at regular intervals and send alert. What I want is that based on the output of my search result can I determine which email alias would be alerted ?

0 Karma