Reporting

Is it possible to send email based on certain condition?

syx093
Communicator

I am trying to send emails based on certain conditions. For example if the host=<host1> the send the email to person1@example.com. If host=<host2> send the email to person2@example.com. If have trying to use the sendemail command but I have not been successful in this attempt.

0 Karma

jeffland
SplunkTrust
SplunkTrust

An alert seems to be exactly what you want to do.
You define a search for host=host1, schedule it to run every five minutes or so, and if it returns results, you send an email to some user. You do that for all alerts you want to receive.

0 Karma

syx093
Communicator

There are about 40 different unique host and mount combination. If I understand what you are suggesting, that would me I would have to create 10 different alerts to get this working.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Oh. Well it is probably possible to do that in an automated fashion as well, maybe via a lookup to determine the adressee and with sendemail. Unfortunately, I don't know how to right off the bat.

0 Karma

syx093
Communicator

That my original approach however the field does not take other fields as an accepted argument. For example, if on of the field is called email, using to=email will make an attempt to send an email to email.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...