Splunk Search

How to send email to different groups based on the criteria?

kollachandra
Path Finder

I would like to send emails to different groups based on number of events returned for a search.

Query:

index=xyz (host=server1) (sc_status=2*) (sc_status!=400*)  
| sort - _time 
| eval Time=strftime(_time, "%m/%d/%y %I:%M:%S %p") 
| eventstats count as TOTAL_COUNT 
| eval recipients = case(TOTAL_COUNT > 100, "qwerty1@abc.com,qwerty2@abc.com,qwerty3@abc.com", TOTAL_COUNT >= 50, "qwerty4@abc.com,qwerty5@abc.com,qwerty5@abc.com", 1==1, null()) 
| table Time,host,c_ip,cs_uri_stem,s_ip,s_port,sc_status,sc_substatus,time_taken
| sendemail to="qwerty1@abc.com,qwerty2@abc.com,qwerty3@abc.com" server=server subject="Here is an email notification" message="This is an example message" sendresults=true inline=true format=table sendpdf=false

This is working fine. But, I am not able to use the recipients custom field created based on the thresholds. I would like to use something like

| sendemail **to=$recipients$** server=server subject="Here is an email notification" message="This is an example message" sendresults=true inline=true format=table sendpdf=false
0 Karma

gjanders
SplunkTrust
SplunkTrust

The sendresults application should be a perfect fit for your scenario.

0 Karma

kollachandra
Path Finder

Thank you for the help.

Everything is good except that I am not able to define the subject of the alert dynamically.

So, can you please let me know if there is a way I can remove the recipient field from the table of the alert and use $result.recipient$ in the to field of the alert.

I am not be able to send the alert using $result.recipient$ but the only issue is if I mention it in the table it is chatty to read the alert. If I remove it by using | fields - recipient then the alert isn't being triggered to the corresponding recipients.

Please help me.

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...