Hello Splunkers,
How can we send email to multiple email addresses using Splunk alert? I saw below documentation in Splunk site, but it doesn't have any sample for multiple emails.
https://docs.splunk.com/Documentation/Splunk/9.0.4/Alert/Emailnotification
Example:
If country=US, recipients will be ameri@gmail.com
If country=Argentina, recipients will be ameri@gmail.com, argentina@gmail.com
If country=Mexico, recipients will be ameri@gmail.com, mexico@gmail.com
If no match, then ameri@gmail.com
Thanks!
I've used eval (recipients fields) same with the documentation, but "," does not worked and recipients doesn't received any emails.
Example:
| eval recipients=if(country, "US", "ameri@gmail.com", if(country, "Mexico", "ameri@gmail.com, mexico@gmail.com"), "ameri@gmail.com")
Have you tried semi-colon rather then comma as a separator between e-mail addresses?
You could consider adding the recipients to the results of the search and using $result.recipients$ in the To: field.