How to send email from ES adaptive response action?

[abi2023]

I want to send customize email from Splunk ES  adaptive response action. How do i add custom templet for email  Message.

second can I make To and Subject dynamic for each notable. pick up from event field?

Thanks  

[meetmshah · Accepted solution]

Hello @abi2023, You will need to have the to and fields available as a part of the results and use the same fields as reference in the to / subject. Below are the detailed steps - 

1. Configure your search query or alert to generate notable events as desired. Ensure that the notable events contain the necessary fields for the "To" and "Subject" values.

2. In the email alert action configuration, you can use tokens to reference the event fields dynamically. Tokens are placeholders that Splunk substitutes with actual values at runtime.

3. To reference a field in the "To" or "Subject" field, enclose the field name within double curly braces. For example, {{field_name}} represents the token for a field called "field_name".

4. Replace the static "To" and "Subject" values in the email alert action with the appropriate tokens. For example, you can set the "To" field as {{field_name_for_to}} and the "Subject" field as {{field_name_for_subject}}.

5. When the email alert is triggered for a notable event, Splunk will substitute the tokens with the actual values from the event fields, generating a dynamic "To" and "Subject" for each notable event.

For example - 

action.email.to = {{field_name_for_to}}
action.email.subject = {{field_name_for_subject}}

(Make sure to replace field_name_for_to and field_name_for_subject with the actual field names from your notable events.)

By using tokens, Splunk will dynamically populate the "To" and "Subject" fields for each notable event based on the event field values when the email alert is triggered.

Feel free to accept the answer if that helps!

[javula]

@meetmshah 

I am trying to implement this solution. It doesn't work for me

When I enter To field {{src_user}} which contains the user email address, I get the error message as "There was an error saving the correlation search: One of the email addresses in 'action.email.to' is invalid