Alerting

How do you dynamically send an email notification to multiple recipients based on the search output?

isamrat
Explorer

I have one alert stanza in my savedsearches.conf. Now, I want to dynamically send email notifications to the consumers based on the output of the result query. Suppose the alert query will give me the below output table after one run:

alt text

Now, based on the consumer names, I should be getting email alerts to different **email Ids** with different email subjects dynamically. So that I don't need to set up multiple alert stanzas in savedsearches.conf for different email recipients.

Please let me know how I can implement this.

0 Karma

chandrasekharko
Path Finder

Install and use sendresults app from the splunkbase to do so.

0 Karma

gjanders
SplunkTrust
SplunkTrust
0 Karma

cmerriman
Super Champion

have you seen this answer?

https://answers.splunk.com/answers/213340/how-to-get-splunk-sendemail-command-to-send-multip.html

I think this might be an approach that will work for your ask.

This documentation might also help. If there is a way you can join email addresses to the consumer, you could use $result.email$ in the To field of the alert.
http://docs.splunk.com/Documentation/Splunk/7.2.0/Alert/Emailnotification#Example_-_Send_email_to_di...

0 Karma

isamrat
Explorer

Thanks for your insights. But I would rather prefer to have some solution based on scripting. Let me know if you have any solution based on scripting.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...