Specific Alert

[geantver0000]

Hi,

I would like to Know if it is possible !
I want to send an email on the adress mail content on my log .

For example:

Index=mail
Result :
log1 : "message information category status Ip data testmail1@mail.com"
log2 : "message information category status Ip data testmail2@mail.com"
log3 : "message information category status Ip data testmail3@mail.com"

Is that possible for the Log1 to send the content of Log1 and send this to the address email on the log ?
For example, to send "message information category status Ip data testmail1@mail.com" to the email on this log : testmail1@mail.com ?

Same for the Log2, it contains information about the testmail2@mail.com and i want to send a mail with the information to testmail2@mail.com ect

Thanks in advance
Steve

[vinod94]

You can try this,

| makeresults | eval data="log1:message information category status Ip data testmail1@mail.com,
log2:message information category status Ip data testmail2@mail.com,
log3:message information category status Ip data testmail3@mail.com" | makemv delim="," data | mvexpand data | eval abc=case(like(data, "log1%"),  "testmail1@mail.com", like(data, "%log2%"),  "testmail2@mail.com", like(data, "%log3%"),  "testmail3@mail.com") |  eval content=case(like(data, "%log1%"),  data, like(data, "%log2%"),  data, like(data, "%log3%"),  data)  |sendemail to=abc message=content