Sending an email on new record

[apaillard]

Hi,

I set a search like |dbquery "dbname" select seq,msg from table order by seq desc.
Now, for each new record I would like to create an alert that sends an email.

Anthony

[apaillard]

Ok my apologies, that was actually pretty simple :
I haven't seen the choice "rises by", and it did the job !!

Anthony

[apaillard]

Hi oldest,
For my understanding it will always send email as my search will everytime returns something.
I just want sending an email when the search returns one or more results as the preview search.

Anthony

[alacercogitatus]

Since you have the search, you can create a scheduled search that has an alert condition, and then sends the email.

http://docs.splunk.com/Documentation/Splunk/latest/Alert/Scheduledsearch#Send_emails_to_a_set_of_sta...