Alerting

Is there any way to set different email receipt for for "send email" alerting action ?

rally0321
Path Finder

Dear all,

We set a few alerts and send to one receipt (DL) and alert work fine now.

we want to send the alert to different receipt for environment-A and environment-B.

the alert search code and other setup are same for 2 environments.

Is there any solution for this?  

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are these different Splunk environments or is environment just a field in the report?

If you want to send to different destinations, the destination has to be in the first line of the result, then you can access it as a token $result.fieldname$

If you set your alert action to trigger for every result, each row could have a different email address.

You would need to try it for your use case, but in the limited tests I have done, it seems to work.

rally0321
Path Finder

Is there approach to refer this $result.fieldname$ as source for action.mail.to ; but not show this field in final search result?

We include the search result as pdf when send alert. thanks.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The field used from the result line must be in the result and therefore will be in the PDF

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...