Splunk Search

How configure an alert to send an email based on field values?

vinuece2007
Engager

Hi All

I have a requirement to trigger an alert email per Service in case of failures.
I don't want to create separate alerts for each service.

My search returns below results example -

ServiceName         Status      Time                EmailContact
ABC                 failed  1/13/2017 8.50 am       xyz@mail.com
ABC                 failed  1/13/2017 8.55 am       xyz@mail.com
DEF                 failed  1/13/2017 9.00 am       bcd@mail.com

How to get two emails from Splunk for ServiceName-ABC and ServiceName DEF?

First email should sent to xyz@mail.com with below 2 rows

ServiceName         Status      Time                EmailContact
ABC                 failed  1/13/2017 8.50 am       xyz@mail.com
ABC                 failed  1/13/2017 8.55 am       xyz@mail.com

Second email should sent to bcd@mail.com with below 1 rows

ServiceName         Status      Time                EmailContact
DEF                 failed  1/13/2017 9.00 am       bcd@mail.com

I have tried to use "map" command in the Custom trigger condition but it is not working.
Please tell me the approach to accomplish this. Thanks !!

Regards
Selvaraj

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| outputlookup MyTempLookup.csv
| stats count by EmailContact
| map maxsearches=9999 search="|inputlookup MyTempLookup.csv
                               | search EmailContact=$EmailContact$
                               | sendemail to=\"$EmailContact$\" format=raw subject=myresults sendresults=true"

woodcock
Esteemed Legend

@ppablo, We could use an admin-accept here, I think.

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...