Several email distribution lists on alert

[mdzmuran]

Hi Splunk Community.

I have an alert, which runs a query regularly, for example hourly 24*7*365. If the alert is triggered, an email is sent to a distrubution list.

I need two distinct distrbution lists on this alert.

One distribution list should receive the email during working hours, Monday 7am to 6pm.

The other distribution list should receive the email outside working hours.

Is there a simple way to do it with just one alert, or is it better to create two identical alerts?

Thanks

Michal 

[mdzmuran]

Later on I may have found one option. I will work on it next week. I could set a new variable in the query with values  "distribution_list_one", "distribution_list_two".  Based on current date and time the variable should be set to one of these values.

Question: Can I put this variable to the To: field in the mail recipient section of the alert.

[richgalloway]

Yes, you can do that.  Put $result.distribution_list$ in the TO field of the alert and have the search set the distribution_list field appropriately.

[richgalloway]

I'd create two alerts.  You just have remember to change both whenever a change is needed.