Can Splunk IT Service Intelligence (ITSI) send email alerts?

[Jarohnimo]

So I've setup Splunk IT Service Intelligence (ITSI) and am interested in setting up Email Alerts with ITSI (if possible)

So far I've been looking into the Multi-KPIAlerts via: https://docs.splunk.com/Documentation/ITSI/2.5.1/User/CreateMulti-KPIAlerts. This creates correlated searches that ultimately create "Notable events" but what about email alerts?

I see the benefit of Multi-KPIAlerts but is there anyway to get an email sent each time a notable event is happens? Or is ITSI able to send out email alerts period?

[aaraneta_splunk]

@Jarohnimo - Did the answer provided by ehudb help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

[ehudb · Accepted solution]

According to this doc:

http://docs.splunk.com/Documentation/ITSI/2.4.1/User/CreateCorrelationSearch

ITSI saves the alerts as a correlation search.
You can find the corresponding correlation search to your multiKPIAlert and add an email action there.