Change alert target email based on data

[smileyge]

I would like to set up an alert that sends an email to an email address contained in the data that the alert triggers on. For example, let's say I have a data set that contains emails, and I want to count those and send those email addresses their counts every week or on some other timing. Can I somehow pipe the email field from the data that generated the alert into the email that is sent, instead of specifying the alert emails should always go to a static address I specify at the time I configure the alert?

[martin_mueller · Accepted solution]

Splunk's alert emails can't do that out of the box. However, you can modify a copy of the sendemail command to roll your own email script that reads receivers from the data rather than from the alert config.

[martin_mueller]

Update: Splunk 6.1 comes with this very feature 🙂