Is it possible to attach a log file to an alert when the alert is triggered?

[aniketb]

Hi,

Is it possible to attach the log file to the Splunk alert when the alert is triggered?

e.g.
if the alert is triggered, can it also attach the source file as part of alert email?

[woodcock]

You cannot directly but you can extend your search by adding this to the end of it to recreate the log file:

| map [index=YourIndexHere source=$source$]

If your original search returns nothing, then so will this extension, but if it returns anything then it will reconstruct the entire file for each result.

[sbbadri]

You will alert email with attachment based on your query output. That is your source right. You want attach external file along with the alert.

If you want result to be attached while alerting below is the link,
http://docs.splunk.com/Documentation/Splunk/6.4.2/Alert/Emailnotification

[aniketb]

let's say my query is:
index=myindex sourcetype=sample "error"

and the string is encountered in error.log file

I want splunk to email me the whole error.log file

[DalJeanis]

Okay, since that would be a file of an unknown size, it's probably not what you really want.

Probably, what you really want is for your alert to kick off a report that will extract certain kinds of records for a certain number of seconds or minutes from the log file and mail that to you.

So, YES, splunk can do that.