Mail in splunk

[logloganathan]

i have written splunk query
index=aaa sourcetype=xyz | stats count by xxx

i want to mail only if count greater than 0 to [email protected] and if count greater than 10 then mail to [email protected]

Could you please help

[ppatrikfr]

Well I dont know if its gonna help you but you can use a schedule search with |sendemail command on it, you can make two different searchs and put a | where conditional for one search up to 0 but less than 10 and another search with greater than 10.

it will be something like this

index=aaa sourcetype=xyz | stats count by xxx
| where count > 0 || count < 10
|sendemail to="[email protected]" 

look at this link for more information about sendemail: http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Sendemail

and second search will be like

index=aaa sourcetype=xyz | stats count by xxx
| where count > 10
|sendemail to="[email protected]" 

Hope it works, if didn't just tell me if you are making an alert of something else, see ya!! 😉

[harishalipaka · Accepted solution]

index=aaa sourcetype=xyz | stats count as total by xxx |eval a=if(total >0 ,"[email protected]",case(total>10,"[email protected]")) | sendemail to=$result.a$  format="html" server=smtp.xxx.com:123 use_tls=1 subject="Alert for Data" message="This is an alert  data" sendpdf=true

[logloganathan]

thanks for your answer!!