Splunk Enterprise

How to send email alert where email is taken from the logs ?

Hi Everyone,

I have data like below,

Certificate1, expirydate-15/7/2020, a@gmail.com

Certificate2, expirydate-18/7/2020, b@gmail.com

I need to setup email alerts in such a way, when expiry date is today , need to send alert to that particular email id automatically. 

I have around 1000 certificates, so if I do it manually, it takes so much time. Is there a way where we can automate this? Please help out.


Labels (1)
Tags (2)
0 Karma


Hi @haripriyasarve1,

You could create a field that includes the email from the search results and in the Alert settings add a token to reference that field in the "To" box like $result.fieldname$


Hope that helps




Karma and/or Solution tagging appreciated.
0 Karma