Splunk Search

Can I have multiple CSVs emailed to me through a single alert?

sarwshai
Communicator

I have created more than 10 alerts for different trigger conditions which send a unique CSV through mail, For e.g. there is field 'Country' in which many countries come and I have set different alerts just to segregate countries but the core search is exactly same of all alerts and each Country CSV file comes in different email
And of course, I can set in one single alert, the question is can I have multiple CSVs emailed to me through that single alert?

0 Karma

horsefez
Motivator

Hi sarwshai,

I think you might need to look at custom alert actions for this case.
http://docs.splunk.com/Documentation/Splunk/7.0.2/AdvancedDev/ModAlertsIntro

Heavy scripting ahead. IMO.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...