Reporting

6.1 - Ability to use field value as email destination for scheduled search

hortonew
Builder

Is there any ability built in to splunk to use a field from a returned search, as a dynamic field in a scheduled search? I'm trying to use a "to" field as the destination (to) field in a schedule email alert.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

martin_mueller
SplunkTrust
SplunkTrust

hortonew
Builder

Huh, nice. I'll try that out tomorrow as well. Thanks!

0 Karma

acharlieh
Influencer

The sendresults app/command should help you out here. It looks for a field named email_to but a rename can work wonders: https://splunkbase.splunk.com/app/1794/

hortonew
Builder

Thanks - didn't think to look at prebuilt apps. I'll dive in and see what it's all about. Appreciate it.

0 Karma

hortonew
Builder

Works like a charm - definitely the way to go. Thanks again.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.