We set a few alerts and send to one receipt (DL) and alert work fine now.
we want to send the alert to different receipt for environment-A and environment-B.
the alert search code and other setup are same for 2 environments.
Is there any solution for this?
Are these different Splunk environments or is environment just a field in the report?
If you want to send to different destinations, the destination has to be in the first line of the result, then you can access it as a token $result.fieldname$
If you set your alert action to trigger for every result, each row could have a different email address.
You would need to try it for your use case, but in the limited tests I have done, it seems to work.
Is there approach to refer this $result.fieldname$ as source for action.mail.to ; but not show this field in final search result?
We include the search result as pdf when send alert. thanks.
The field used from the result line must be in the result and therefore will be in the PDF