Reporting

Is it possible to send email based on certain condition?

syx093
Communicator

I am trying to send emails based on certain conditions. For example if the host=<host1> the send the email to person1@example.com. If host=<host2> send the email to person2@example.com. If have trying to use the sendemail command but I have not been successful in this attempt.

0 Karma

jeffland
SplunkTrust
SplunkTrust

An alert seems to be exactly what you want to do.
You define a search for host=host1, schedule it to run every five minutes or so, and if it returns results, you send an email to some user. You do that for all alerts you want to receive.

0 Karma

syx093
Communicator

There are about 40 different unique host and mount combination. If I understand what you are suggesting, that would me I would have to create 10 different alerts to get this working.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Oh. Well it is probably possible to do that in an automated fashion as well, maybe via a lookup to determine the adressee and with sendemail. Unfortunately, I don't know how to right off the bat.

0 Karma

syx093
Communicator

That my original approach however the field does not take other fields as an accepted argument. For example, if on of the field is called email, using to=email will make an attempt to send an email to email.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...