Refining alert using per $result.host$ -- How to generate separate alerts per host?

[the_wolverine]

I have a need to generate alerts from a single scheduled search:

• Show me all the events PER HOST matching my condition
• Send a separate alert PER HOST
• Email a different user PER HOST

Can this be done without external scripts?

[solarboyz1]

Configure the saved search.
Use a lookup in the search, that matches the email recipient to the alert they need to recieve.

Schedule it to alert.
Set alert mode per-result.

Set alert action send email
Set email recipient token from the event as the sendto field.

[woodcock]

If you need to send a contextually-approrpriate subset of results to some people, you can skip the configuration-based email settings and do this in SPL directly:

... | outputcsv TempFile.csv
| stats values(Email_Address) AS emailToHeader | mvexpand emailToHeader
| map search="|inputcsv TempFile.csv | where Email_Addresss=\"$emailToHeader$\"
   | fields - Email_Address
   | sendemail
      sendresults=true inline=true
      server=\"Your.Value.Here\"
      from=\"Your.Value.Here\"
      to=\"$emailToHeader$\"
      subject=\"Your Subject here: \$name\$\"
      message=\"This report alert was generated by \$app\$ Splunk with this search string: \$search\$\""
| search ThisFieldWillNeverExist="SoThisCommandWillDropAllEventsSoThatYouCanPullInTheOriginalSetWhichYouMightOrMightNotCareToDo"
| appendpipe [|inputcsv TempFile.csv]

The only downside to this approach is that If the search dose not return any results it will produce the following error:

"Error in "map": Did not find value for required attributes 'emailToHeader'

This is "normal" and I have not found a good way to code around it.

[jkat54]

you could script this in your search like this:

...|eval sendTo=if(case(host==host1,"user@domain.tld",host==host2,"user2@domain.tld")) | where count>0 | sendemail to=$result.sendTo$ ...

Not certain the sendTo command is correct in my example but it sounds like you can figure it out from there.