How to put the result of an additional search into an alert email triggered by the base search?

[SY715]

Hi

Is there any way to put the search result of additional search into the alert mail triggered by the base search?
For example, following two search strings will get totally different results from different source types.

search strings A : the result shows the number of errors in source type A
search strings B : the result shows the number of users in source type B

Now, I'd like to distribute an alert e-mail when the result of search string A meets certain condition (like >5 ), then submit the search strings B simultaneously and put the result of B into that alert e-mail. The search strings A is the based search that is scheduled every 1 minute to make a trigger for e-mail alert. On the other hand, the search strings B is the additional search that should be submitted only when the trigger is created and to make a result put in e-mail alert.

According to the splunk documentation, only the result of the original search could be put in the alert e-mail. So I'd like to know whether I could put the result of search B in the alert e-mail instead of A.

The important point is that I'd like the search strings B to be submitted only when the trigger is created in order to save the power of splunk. There might be a way to search both A and B as the based search but that seems to use a lot of power.

The ideal is putting the result of search B into the alert e-mail body, but attaching PDF or any other way than RSS is fine.

[vinitatsky · Accepted solution]

You can do this by
1) Create an alert for base search using search string A.
2) Trigger a script (perl or python) whenever above alert is triggered.
3) In the script - You can perform a Splunk search using String B and send an email also.
http://dev.splunk.com/view/python-sdk/SP-CAAAEFK#explorer

There are serveral ways of calling search from the script. i.e. using curl command, using RESP APIs.
Just an example -
curl --write-out "%{http_code}" -u : -k https://localhost:8089/services/search/jobs/export --data-urlencode search="search " -d output_mode=json -d earliest="rt-5m" -d latest="rt"

[SY715]

Thank you!