Splunk Search

How to send alerts to multiple emails based on lookup table match on host owners?

Path Finder

We currently have a lookup table with hosts and their respective owner email.

host ; host owner email
ABCD1234 ; ABCD1234Dist@emailadd.com
XYZ123 ; XYZ123Dist@emailadd.com

We'd like to trigger email alerts if any host becomes non-compliant by the 6th day to warn the owners to remediate the issues before they get on the 7th-day non-compliant report. Given, that the two sample hosts above meet this condition, how would we incorporate this logic into the email alerting, if not through the alert wizard?

Thanks for any help!

0 Karma

Esteemed Legend

You will need these commands:

stats, map, and sendemail

If you give more logic and example searches, then people will give more specific answers.

0 Karma


I think the "sendemail" command is what you're looking for.


0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...