Splunk Search

How configure an alert to send an email based on field values?

vinuece2007
Engager

Hi All

I have a requirement to trigger an alert email per Service in case of failures.
I don't want to create separate alerts for each service.

My search returns below results example -

ServiceName         Status      Time                EmailContact
ABC                 failed  1/13/2017 8.50 am       xyz@mail.com
ABC                 failed  1/13/2017 8.55 am       xyz@mail.com
DEF                 failed  1/13/2017 9.00 am       bcd@mail.com

How to get two emails from Splunk for ServiceName-ABC and ServiceName DEF?

First email should sent to xyz@mail.com with below 2 rows

ServiceName         Status      Time                EmailContact
ABC                 failed  1/13/2017 8.50 am       xyz@mail.com
ABC                 failed  1/13/2017 8.55 am       xyz@mail.com

Second email should sent to bcd@mail.com with below 1 rows

ServiceName         Status      Time                EmailContact
DEF                 failed  1/13/2017 9.00 am       bcd@mail.com

I have tried to use "map" command in the Custom trigger condition but it is not working.
Please tell me the approach to accomplish this. Thanks !!

Regards
Selvaraj

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| outputlookup MyTempLookup.csv
| stats count by EmailContact
| map maxsearches=9999 search="|inputlookup MyTempLookup.csv
                               | search EmailContact=$EmailContact$
                               | sendemail to=\"$EmailContact$\" format=raw subject=myresults sendresults=true"

woodcock
Esteemed Legend

@ppablo, We could use an admin-accept here, I think.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...