send an alert to appropriate responsible person

[iswiau]

Hello Friends,

My search returns the following:

serverName	errorNumber	responsiblePerson	responsblePersonEmail
server_a	4586	Bob M.	bobm@tmail.com
server_a	1236	Bob M.	bobm@tmail.com
server_a	788	Bob M.	bobm@tmail.com
server_b	468	Bob M.	bobm@tmail.com
server_b	8798	Bob M.	bobm@tmail.com
server_c	5647	Amelia S.	amelias@tmail.com
server_c	556	Amelia S.	amelias@tmail.com
server_c	789	Amelia S.	amelias@tmail.com
server_c	8799	Amelia S.	amelias@tmail.com

I want to send alerts by email to appropriate responsible person.

Each responsible person should receive ONLY ONE email that contain ALL errors on the servers for which he is responsible.

In this example Bob should receive one email that contain 5 lines (3 for server_a and 2 for server_b), and Amelia should receive one email that contain 4 lines (for server_c).

Any help would be appreciated!

[iswiau · Accepted solution]

Thank you for the quick answers.

The task assigned to me has changed
The customer wants to receive a separate email for each server.
This made solving the problem very simple  🙂

| stats values(*) as * by serverName

and than set the alert to trigger for each result.

Thank you very much!

[PickleRick]

Use stats values() or stats list() to group events by recipient. Then use sendresults - https://splunkbase.splunk.com/app/1794

[inventsekar]

Hi @iswiau .. May we know, do you have only a small list of id's.. or a big list of people?

if you have only a small list of ids... you can use a if condition and select the email id. 

or, you can create a notepad file with the email ids and use map command like this..

... | outputcsv TempFile.csv
| stats values(Email_Address) AS emailToHeader | mvexpand emailToHeader
| map search ="|inputcsv TempFile.csv | where Email_Addresss=\"$emailToHeader$\"
   | fields - Email_Address
   | sendemail
      sendresults=true inline=true
      server=\"Your.Value.Here\"
      from=\"Your.Value.Here\"
      to=\"$emailToHeader$\"
      subject=\"Your Subject here: \$name\$\"
      message=\"This report alert was generated by \$app\$ Splunk with this search string: \$search\$\""
| where comment="MakeSureNoEventsRemail"
| append [|inputcsv TempFile.csv]

this above one is from this page