Splunk ES - Adaptive Response - Send Email per Result of Correlation Search

[gworkun]

Hey Team,

Wanted to be able to send an email as an Adaptive Response for a correlation search per result. Just like a notable event is created per-event, is there a way to configure the "Send Email" to be sent per-event, based on information in the notable event?

For example, if a correlation search has 5 hits, 5 notable events are created. Let's say there are 5 different email addresses on these 5 events; is it possible to use "$result.email$" to alter who get the email per event?

I know a limitation or the design of $result.email$ is just to take the first row, but was thinking when used in conjunction with Correlation search, there might be a way to utilize the Adaptive Response per event.

Thoughts? Any additional data needed? Thanks all!

[lakshman239]

Lets say you have a field called myemail_addr in each of the 5 events, resulting from your correlation search, you can use that as a token $myemail_address$ in the email adaptive response to send different email to each of the 5 users. would this help?