Splunk alerts use values from search

[bbegyperkspot]

Is there a way to send alerts to email addresses derived from my search? For example, recording an email address that has failed to log in to our web app N times and sending an alert to that user?

If not, how do we get this on the product roadmap?

[jbrodsky_splunk]

Ron Naken's RedAlert app can allow you to use field value(s) in your alerts. It also provides some very nice alert tracking. https://apps.splunk.com/app/1730/

[somesoni2]

See this link.
http://docs.splunk.com/Documentation/Splunk/6.2.0/Alert/Setupalertactions#Use_tokens_in_email_notifi...

You should be able to configure you "To" addresses with the fields from search result.

Alternately, your can look at the "sendemail" command of the search language to send the email alert from search itself.