Alerting

Conditional actions on an alert

bhavneesh94vohr
New Member

I want to trigger alert action based on result of a query.I have used a eval command in query ,if the result of eval command is true then i want to add content to a lookup as well as send an email,if result is false i just want to add it to a lookup.How can it be done?

Tags (1)
0 Karma

vishaltaneja070
Motivator

@bhavneesh94vohra
I will suggest you to create alert for sending mail in case eval condition is true. And a schedule report which will always send data to lookup.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...