Configure alert to send email to a certain field value?

[evallja]

Hello everyone,

I have the following results when running my search:

_time                                        user             connection
1 2023-01-09 20:36:04   john        Transport closing
2 2023-01-09 20:32:45   brian      DPD failure
3 2023-01-09 19:44:26   tom         assigned to session

Please, I want to configure an alert to send the _raw field by email to the specific user (by adding @Anonymous.com), every time it returns results from that user, (ex. john@gmail.com, brian@gmail.com, tom@gmail.com)

Thank you in advance.

[PaulPanther · Accepted solution]

Just use eval to set up a new internal field  

| eval _mail_address=user + "@gmail.com," 

 and then use this field in your alert as recipient $result._mail_address$. Finally set the trigger to "For each result" to send each line to the specific mail_address.