Splunk alert - querying a lookup to send mails to respective id, with complete row information

[Le]

I have a lookup file like below, the query should send mails to each person with that respective row information. and if mail1 column is empty, then query should consider mail2 column value to send mails. and if mail2 column is empty, the query should consider mail3 column value to send mail. and if mail1, mail2 are empty then query should consider mail3 column value to send mail.

Emp	occupation	location	firstmail	secondarymail	thirdmail
abc	aaa	hhh	aa@mail.com	gg@mail.com
def	ghjk	gggg	bb@mail.com	ff@mail.com
ghi	lmo	iiii		hh@mail.com
jkl	pre	jjj			dd@mail.com
mno	swq	kkk	aa@mail.com	ii@mail.com

example, aa@mail.com..should receive mail like below in tabluar format

Emp	occupation	location	firstmail	secondarymail	thirdmail
abc	aaa	hhh	aa@mail.com	gg@mail.com
mno	swq	kkk	aa@mail.com	ii@mail.com

so likewise query should read complete table and send mails to persons individually....containing that specific row information in tabluar format. Please help me with the query and let me know incase of any clarification on the requirement.

[ITWhisperer]

You could construct your search so that each row has a field with the name of the recipients. Then set up the alert so that it triggers for every result. Then use the $row.field$ token as the recipient in the trigger action.

Note that this will mean that the recipients will get multiple emails if their address appears in more than one row of the report.

[Le]

Thank you for it but i need one mail to be sent though a recipient has multiple rows of data.

[ITWhisperer]

In that case, gather all the information for each user into a single row for that user or submit an idea to Splunk to try to get the functionality changed.