How to generate multiple alert email based on 2 conditions?



I have a requirement to generate alerts every 15 mins if a particular condition occurs. Then I need to group data from a few server in one alert and data from other set of server in another alert.
srvrA - srvr1,srvr2
srvrB - srvr3,srvr4,srvr5

Email for srvrA:
fieldA | field B | _raw
A1 | B1 | Event1
A1 | B2 | Event2

Email for srvrB:
fieldA | fieldB | _raw
A3 | B3 | Event1
A1 | B3 | Event2

Could you please help me how to use the condition from same query and send 2 different emails.

0 Karma


If you add the recipients on a new column, you can configure the alert to send to $results.recipient$, and must set the alert to process a new email for each result. You can even aggregate the results with values() or list() so that each recipient only receives one alert. ( Tested on 6.5.x )

stats values(fieldA) values(fieldB) values(_raw) by recipient

fieldA | field B | _raw | recipient
A1 | B1 | Event1 | ServersA@xxx.xx
A1 | B2 | Event2 |
A3 | B3 | Event1 | ServersB@xxx.xx
A1 | B3 | Event2 |

on savedsearches.conf : = $result.recipient$
alert.digest_mode = 0

0 Karma


Not sure if this is what you were aiming for but martin had a good suggestion here:

@Roopal: Even i got similar kind of requirement, did u find any solution for sending multiple alerts?

0 Karma


Create two alerts, both to run every 15mins looking for similar conditions to occur. Example

*Alert 1*
host=srvr1 OR host=srvr2 | stats count on alertcondition

*Alert 2*
host=srvr3 OR host=srvr4 OR host=srvr5 | stats count on alertcondition

Then setup alerts for each of these searches.

0 Karma


Thanks sundareshr.

Yes, I am aware of it that 2 different alerts can be created. But i would like to know if there is a way this can be handled in a single alert or single saved search.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!