Is it possible to use fields from events to populate email alert variables?

[tkwaller]

Hello everyone

I'm am trying to find if you can use fields from events to populate email alert variables. As an example, say I have the following event that triggers an alert:

Sample log format

14:09:22.686 [eventsJmsContainer-1] INFO   _message="Ready to send email" jobGUID=999999999999, emailTo=example@somewhere.com, emailCC=, subject=Job Status Report for Job ID 1050221354, emailText=Job Summary:

Job Unique ID: 1440104961583
Job status: COMPLETED
Job Details: Enrichment: File Name="events.csv_1440104961583", Unique ID=1440104961583, User="testuser@somewhere.com", Source="MySource"
Result: Total Records = 1, # Passed = 0, # Failed = 1
Start Time: Aug 20, 2015 2:09:22 PM
End Time: Aug 20, 2015 2:09:22 PM
Duration (seconds): 0

Row-level Failures (if any):

Entity ID: abcd1234
com.somewhere.domain.mydomian.mytools.v1.common.exception.ReadAPIException: Unexpected character ('<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
 at [Source: protocol.http.HttpURL.HttpInputStream@999abc123; line: 1, column: 2]

What I would like to do is have the email alert use the "emailTo" field to set the email to address, the "emailCC" field to set the CC address, "subject" field to set the subject of the email and the "emailText" field to populate the body of the email.

Is this a possibility?
Thanks for any input!

[sandyasampath]

You might find this useful - http://docs.splunk.com/Documentation/Splunk/6.5.2/Alert/EmailNotificationTokens

[johnsjm]

The only reason a script would be needed is if a CC email header was absolutely required, why not put all recipients into the "To:" field: $result.emailTo$, $result.emailCC$, Subject: $result.subject$ and the Body of the message could be eval'ed first and then just set to $result.emailText$.

[Cesaredf]

I just want to confirm that in 6.1 via web interface the variable $result.host$ works too.

[gbower333]

In 6.2 I have been able to add a host value into email alert subjects by adding a variable. In savedsearches.conf under the alert stanza:
action.email.subject = $name$ : $result.host$
You can also add the variable via the web interface.
I am not sure about custom fields though.

[woodcock · Accepted solution]

The only way to do this is to set it as an Alert and have the Alert call a script. In the script you can access the search results and do whatever you like with it. Once this is done, you can call sendmail or whatever directly from the script.

[tkwaller]

That's what I had anticipated but just wanted to check before diving in. Thanks for the advice!

[johnsjm]

I had to re-read the question again but the only reason a script would be needed is if a CC email header was absolutely required, why not put all recipients into the "To:" field: $result.emailTo$, $result.emailCC$, Subject: $result.subject$ and the Body of the message could be eval'ed first and then just set to $result.emailText$.

[marcoscala]

Hi! I DO need to do the same BUT with the action.email.to field! I get the recipient in a lookup!

The UI doesn't like $result.resp_email$ (resp_email is my field with the email of the recipient).
Thanks a lot!