How to send alerts to multiple emails based on lookup table match on host owners?

[tmaltizo]

We currently have a lookup table with hosts and their respective owner email.

host ; host owner email
ABCD1234 ; ABCD1234Dist@emailadd.com
XYZ123 ; XYZ123Dist@emailadd.com

We'd like to trigger email alerts if any host becomes non-compliant by the 6th day to warn the owners to remediate the issues before they get on the 7th-day non-compliant report. Given, that the two sample hosts above meet this condition, how would we incorporate this logic into the email alerting, if not through the alert wizard?

Thanks for any help!
Trista

[woodcock]

You will need these commands:

stats, map, and sendemail

If you give more logic and example searches, then people will give more specific answers.

[jimodonald]

I think the "sendemail" command is what you're looking for.

https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Sendemail