Is it possible to attach a log file to an alert when the alert is triggered?

Path Finder


Is it possible to attach the log file to the Splunk alert when the alert is triggered?

if the alert is triggered, can it also attach the source file as part of alert email?

0 Karma

Esteemed Legend

You cannot directly but you can extend your search by adding this to the end of it to recreate the log file:

| map [index=YourIndexHere source=$source$]

If your original search returns nothing, then so will this extension, but if it returns anything then it will reconstruct the entire file for each result.

0 Karma


You will alert email with attachment based on your query output. That is your source right. You want attach external file along with the alert.

If you want result to be attached while alerting below is the link,

0 Karma

Path Finder

let's say my query is:
index=myindex sourcetype=sample "error"

and the string is encountered in error.log file

I want splunk to email me the whole error.log file

0 Karma


Okay, since that would be a file of an unknown size, it's probably not what you really want.

Probably, what you really want is for your alert to kick off a report that will extract certain kinds of records for a certain number of seconds or minutes from the log file and mail that to you.

So, YES, splunk can do that.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...