Alerting

Is there a way to set conditions for an alert to "sendmail" custom messages based on different values of certain fields?

packet_hunter
Contributor

I currently have two scheduled alerts that sendmail when the alert is triggered. The problem is that I would like to create just one alert with multiple conditions where if some_field = a then sendmail To: Recipient1 with Message: Event "a" occurred , please follow process "a". And if some_field = b then sendmail To: Recipient2 with Message: Event "b" occurred, please follow process "b", etc.

Some will probably suggest, just create separate alerts... which would work, but we don't want to overload the system with too many real-time or scheduled searches.

I was thinking about using eval with sendmail but need a little help with writing the code.

Thanks

0 Karma
1 Solution

frobinson_splun
Splunk Employee
Splunk Employee

Hi @packet_hunter,
It sounds like you could use eval match to check for the field value that determines the recipient and content of your message, then use tokens to represent the field and recipient values. Set the recipient value conditionally depending on what the field value is, and use the tokenized field value in your email message to customize it.

See:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/EmailNotificationTokens
and
https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Eval

Here's an example use of eval + match to evaluate the "source" field for different values and set the "env" token accordingly. This search was used to generate form input labels.

<search>
      <query>index=_internal | stats count by source |eval env=case(match(source,"metrics.*"),"Metrics", match(source,"license.*"),"License", match(source,"scheduler.*"), "Scheduler") | dedup env | table env</query>
    </search>

source: https://answers.splunk.com/answers/495097/why-is-my-dashboard-search-not-getting-updated-wit.html#co...

View solution in original post

frobinson_splun
Splunk Employee
Splunk Employee

Hi @packet_hunter,
It sounds like you could use eval match to check for the field value that determines the recipient and content of your message, then use tokens to represent the field and recipient values. Set the recipient value conditionally depending on what the field value is, and use the tokenized field value in your email message to customize it.

See:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/EmailNotificationTokens
and
https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Eval

Here's an example use of eval + match to evaluate the "source" field for different values and set the "env" token accordingly. This search was used to generate form input labels.

<search>
      <query>index=_internal | stats count by source |eval env=case(match(source,"metrics.*"),"Metrics", match(source,"license.*"),"License", match(source,"scheduler.*"), "Scheduler") | dedup env | table env</query>
    </search>

source: https://answers.splunk.com/answers/495097/why-is-my-dashboard-search-not-getting-updated-wit.html#co...

gjanders
SplunkTrust
SplunkTrust

As an alternative, may I suggest sendresults ? I've used this to send different results to different people within the same alert, it also works by using eval's as above...

0 Karma

packet_hunter
Contributor

Do you have a token example by chance? Thank you

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

You can take a look at:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Alertexamples

which includes an example of adding tokens to the email notifcation configuration fields

and

http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Emailnotification

If you're new to working with tokens, we have an overview here:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens

This topic discusses token usage in a dashboard context, but the general idea (using tokens to represent dynamic values) is the same.

Hope that helps!

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Also, here's an example of a query that lets you send notifications to different recipients based on a field count. It sounds pretty similar to what you're doing.

http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Emailnotification#Send_email_to_different_re...

0 Karma

packet_hunter
Contributor

Thank you for the reply, I will look into it and try it and let you know.

Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...