Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- Sending Alert email to the extracted user field
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have set up alerts in Splunk and usually I hard-code the recipients email id in the TO field, and it works flawlessly.
But in this case , I cannot hardcode the user email id in the alert's TO field, because the user ID has to be extracted from the event (from the event that satisfies the alert condition).
Example (sample event that will satisfy the alert query):
40.145.234.438 329x399740x1 PERSON1 [09/Mar/2020:05:29:23 -0400] "DELETE /rest/api/2/issue/TES1-2/butchers?username=PERSON2 HTTP/1.1" 204 - 40 "https://phutan-dev.mayhem.com/browse/RES1-2" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36" "1k35v6f"
IF the word butcher is identified then the event should be picked (I can handle until this) and from the event extract PERSON1 and PERSON2 field and trigger email to these two PERSONS as PERSON1@mayhem.com. PERSON2@mayhem.com through the alert.
I have extracted PERSON1 and PERSON2 from the event. I'm just looking to append @mayhem.com to them and trigger alert emails to these two persons only.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use result token $result.fieldname$. First value for the specified field name from the first search result row is used.
In the To field, set value like this. Here PERSON1 and PERSON2 are field names.
$result.PERSON1$@mayhem.com,$result.PERSON2$@mayhem.com
If each row has different values for fields PERSON1 and PERSON2 then set Trigger settings to for each result in Edit alert page.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use result token $result.fieldname$. First value for the specified field name from the first search result row is used.
In the To field, set value like this. Here PERSON1 and PERSON2 are field names.
$result.PERSON1$@mayhem.com,$result.PERSON2$@mayhem.com
If each row has different values for fields PERSON1 and PERSON2 then set Trigger settings to for each result in Edit alert page.
Thanks for the Memories! Splunk University, .conf25, and our Community
Data Persistence in the OpenTelemetry Collector
Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever
