How to add multiple email addresses in Splunk Alert based on field value?

[whitefang1726]

Hello Splunkers, 

How can we send email to multiple email addresses using Splunk alert? I saw below documentation in Splunk site, but it doesn't have any sample for multiple emails. 

https://docs.splunk.com/Documentation/Splunk/9.0.4/Alert/Emailnotification

Example: 

If country=US, recipients will be ameri@gmail.com
If country=Argentina, recipients will be ameri@gmail.com, argentina@gmail.com
If country=Mexico, recipients will be ameri@gmail.com, mexico@gmail.com
If no match, then ameri@gmail.com

Thanks!

[whitefang1726]

I've used eval (recipients fields) same with the documentation, but "," does not worked and recipients doesn't received any emails. 

Example: 

| eval recipients=if(country, "US", "ameri@gmail.com", if(country, "Mexico", "ameri@gmail.com, mexico@gmail.com"), "ameri@gmail.com")

[ITWhisperer]

Have you tried semi-colon rather then comma as a separator between e-mail addresses?

[ITWhisperer]

You could consider adding the recipients to the results of the search and using $result.recipients$ in the To: field.