Splunk Search

Configure alert to send email to a certain field value?

evallja
Path Finder

Hello everyone,

I have the following results when running my search:

_time                                        user             connection
1 2023-01-09 20:36:04   john        Transport closing
2 2023-01-09 20:32:45   brian      DPD failure
3 2023-01-09 19:44:26   tom         assigned to session

Please, I want to configure an alert to send the _raw field by email to the specific user (by adding @Anonymous.com), every time it returns results from that user, (ex. john@gmail.com, brian@gmail.com, tom@gmail.com)

Thank you in advance.

Tags (3)
0 Karma
1 Solution

PaulPanther
Motivator

Just use eval to set up a new internal field  

 

| eval _mail_address=user + "@gmail.com," 

 

 and then use this field in your alert as recipient $result._mail_address$. Finally set the trigger to "For each result" to send each line to the specific mail_address.

View solution in original post

PaulPanther
Motivator

Just use eval to set up a new internal field  

 

| eval _mail_address=user + "@gmail.com," 

 

 and then use this field in your alert as recipient $result._mail_address$. Finally set the trigger to "For each result" to send each line to the specific mail_address.

Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...