Archive

set up a alert and send 2 separate mails as per the condition in the query

Path Finder

I have this query can we set up a alert and send 2 separate mails as per the condition in the query .
index=xyz sourcetype=123 Message="Started" (host=host1 OR host=host2 OR host=host3)
| dedup host
| stats count
| where count <=3
One mail if count is < 3 and one mail when count is = 3 .
Is this possible 😐

Tags (1)
0 Karma
1 Solution

Esteemed Legend

Read this:

http://docs.splunk.com/Documentation/Splunk/latest/Alert/Emailnotification#Send_email_to_different_r...

So, like this:

index=xyz sourcetype=123 Message="Started" (host=host1 OR host=host2 OR host=host3) 
| dedup host 
| stats count 
| where count <=3
| eval recipient=case(count<3, "recipient1@domain.com", count=3, "recipient2@domain.com", 1==1, null()) | where isnotnull(recipient)

Then when the search is saved as an alert, configure the Send email alert action with the following token in the To recipient field: $result.recipient$

0 Karma

Path Finder

Thank you for your answer, but I have already accepted the above answer 🙂

0 Karma