Alerting

How to configure the same alert for internal and external client

amitlookin
Loves-to-Learn Lots

i have a alert created in Splunk. Can anyone please guide as to what setting has to be done in Edit Alert->Trigger Alert-> Send Email section to make sure that when the alert triggers and if the email has to be sent internally then it should have subject line as [INTERNAL]{Subject line content} with defined recipient and if the email has to be sent outside the organisation the subject line should be {Subject line content} with its defined recipient list.

Do i need to create 2 separate copies of same alert with these 2 configuration in Edit Alert setting defined or these both conditions can be saved in the configuration for single alert.

 

 

Labels (2)
0 Karma

cmerriman
Super Champion

Do different lines of the alert get sent to different recipients? Or is it just that one copy of the alert get sent internally and one copy of the exact same dataset get sent externally?

0 Karma

amitlookin
Loves-to-Learn Lots

The alert is same with same logic the only difference lies in the subject line and the message body depending upon to whom the alert will be send (Internal or External to the organisation).

Thanks for responding.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...