Splunk Enterprise

How to send email alert where email is taken from the logs ?

haripriyasarve1
Explorer

Hi Everyone,

I have data like below,

Certificate1, expirydate-15/7/2020, a@gmail.com

Certificate2, expirydate-18/7/2020, b@gmail.com

I need to setup email alerts in such a way, when expiry date is today , need to send alert to that particular email id automatically. 

I have around 1000 certificates, so if I do it manually, it takes so much time. Is there a way where we can automate this? Please help out.

 

Labels (1)
Tags (2)
0 Karma

rnowitzki
Builder

Hi @haripriyasarve1,

You could create a field that includes the email from the search results and in the Alert settings add a token to reference that field in the "To" box like $result.fieldname$

https://docs.splunk.com/Documentation/Splunk/8.0.5/Alert/EmailNotificationTokens

Hope that helps

Ralph

 

 

--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...