sendresults in Splunk Alert

[rchakka]

can we use sendresults command in a splunk alert ?

for example,i am creating an alert to trigger email via sendresults when a specific condition is triggered

"my query"| eval email_to="abc@123.com"
| sendresults showemail=f subject=" Password Changed alert" body="The password on your Network account has changed. If you did not initiate this change, please contact your system administrator."

Note: the email is generated when i perform the search ,but it is not working when used in the alert

[woodcock]

Yes, but you have control over your saved search; you can set it to Run as owner or Run as user. Obviously, the permissions vary user-to-user. Make sure that it runs for you, then you have a choice to make: give everyone enough permissions so they can run it, too, or have it Run as owner.

[jkat54]

For alerts we use sendalert. It’s a little different.

But if you just save the search as an alert, splunk will do that for you.

[jkat54]

Save as alert without sendemail command that is. Then add a trigger condition and make it send an email as the action.

[rchakka]

thanks for the response.

what if the email is variable field?

for example
"my query"| eval email_to=$test$
| sendresults showemail=f subject=" Password Changed alert" body="The password on your Network account has changed. If you did not initiate this change, please contact your system administrator."

[jkat54]

See this article and change the version to your correct splunk version:

https://docs.splunk.com/Documentation/Splunk/7.1.1/Alert/EmailNotificationTokens

In 7.1.1 for example you’d use $result.fieldName$ in your email subject, to/cc/bcc, body,
Etc

[rchakka]

"my query"| eval email_to=$test$
| sendresults showemail=f subject=" Password Changed alert" body="The password on your Network account has changed. If you did not initiate this change, please contact your system administrator."

I used in the alert email field

TO $result.test$

but still no luck with email. note: the query is working fine.

[jkat54]

Where is $test$ coming from? Drop down menus or fields in the data?

[rchakka]

fields in the data from my search

[rchakka]

Identified an issue with realtime alerting .the alert is triggering first time only when we use variable field in send mail to field. Anyone with similar issues? i am using splunk cloud? thank you all.