Reporting

alert

uagraw01
Builder

Hello Members,

I have a requirement, in which i have 5 servers, in which i want to send and alert. 

In which five server are :

a, b,c,d,e,f

I want to set an alert in which when the CPU utilization is high on server a --- then alert send to one specific email id @@abc.splunk.com  and for the other 4 servers i want to send an alert on email group---xyz@splunk.com.

In splunk alert setting there is no option, we need to put through SPL by using the eval, but it is not working for me.

I have tried as below :

| eval condition_alert=if(server == "a", "abc.splunk.com", "xyz@splunk.com") --- it is not working

| eval condition_alert=if(LIKE(server,"%a%"),"abc.splunk.com", "xyz@splunk.com") --- it is also not working.

 

Please suggest me the solution.

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...