Is there any way to set different email receipt for for "send email" alerting action ?

[rally0321]

Dear all,

We set a few alerts and send to one receipt (DL) and alert work fine now.

we want to send the alert to different receipt for environment-A and environment-B.

the alert search code and other setup are same for 2 environments.

Is there any solution for this?  

[ITWhisperer]

Are these different Splunk environments or is environment just a field in the report?

If you want to send to different destinations, the destination has to be in the first line of the result, then you can access it as a token $result.fieldname$

If you set your alert action to trigger for every result, each row could have a different email address.

You would need to try it for your use case, but in the limited tests I have done, it seems to work.

[rally0321]

Is there approach to refer this $result.fieldname$ as source for action.mail.to ; but not show this field in final search result?

We include the search result as pdf when send alert. thanks.

[ITWhisperer]

The field used from the result line must be in the result and therefore will be in the PDF