Alerting

Splunk alert result(s) to a dashboard input and then email results

pateriaak
Explorer

How can I send alert result(s) to a dashboard input and then email dashboard results? Please let me know if anybody has worked on this before. thank you!

0 Karma

dannyze
Explorer

As mentioned you can also schedule from a Dashboard itself if this fits your use case.
After a Dashboard has been created Edit > Schedule > Email To

0 Karma

jethrop
Explorer

If you are using the monitoring console or have it as a search peer, try the below:
index=_audit action="alert_fired" AND host=YOUR_DMC
| eval severity=case(severity==1,"debug", severity==2, "info", severity==3,"warning", severity==4,"error",severity=5,"severe",severity==6,"fatal")
| rename ss_app as monitoring_app
| table ss_name, severity, timestamp, monitoring_app

You can then create a dashbaord from this as well as an email action that has the table above inline.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...