Mail in splunk

[logloganathan]

i have written splunk query
index=aaa sourcetype=xyz | stats count by xxx

i want to mail only if count greater than 0 to xyz@xyz.com and if count greater than 10 then mail to abcd@xyz.com

Could you please help

[ppatrikfr]

Well I dont know if its gonna help you but you can use a schedule search with |sendemail command on it, you can make two different searchs and put a | where conditional for one search up to 0 but less than 10 and another search with greater than 10.

it will be something like this

index=aaa sourcetype=xyz | stats count by xxx
| where count > 0 || count < 10
|sendemail to="emailreceiver@emai.com" 

look at this link for more information about sendemail: http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Sendemail

and second search will be like

index=aaa sourcetype=xyz | stats count by xxx
| where count > 10
|sendemail to="emailreceiver@emai.com" 

Hope it works, if didn't just tell me if you are making an alert of something else, see ya!! 😉

[harishalipaka · Accepted solution]

index=aaa sourcetype=xyz | stats count as total by xxx |eval a=if(total >0 ,"abc@gmail.com",case(total>10,"xyz@gmail.com")) | sendemail to=$result.a$  format="html" server=smtp.xxx.com:123 use_tls=1 subject="Alert for Data" message="This is an alert  data" sendpdf=true

[logloganathan]

thanks for your answer!!