Specific Alert

[geantver0000]

Hi,

I would like to Know if it is possible !
I want to send an email on the adress mail content on my log .

For example:

Index=mail
Result :
log1 : "message information category status Ip data [email protected]"
log2 : "message information category status Ip data [email protected]"
log3 : "message information category status Ip data [email protected]"

Is that possible for the Log1 to send the content of Log1 and send this to the address email on the log ?
For example, to send "message information category status Ip data [email protected]" to the email on this log : [email protected] ?

Same for the Log2, it contains information about the [email protected] and i want to send a mail with the information to [email protected] ect

Thanks in advance
Steve

[vinod94]

You can try this,

| makeresults | eval data="log1:message information category status Ip data [email protected],
log2:message information category status Ip data [email protected],
log3:message information category status Ip data [email protected]" | makemv delim="," data | mvexpand data | eval abc=case(like(data, "log1%"),  "[email protected]", like(data, "%log2%"),  "[email protected]", like(data, "%log3%"),  "[email protected]") |  eval content=case(like(data, "%log1%"),  data, like(data, "%log2%"),  data, like(data, "%log3%"),  data)  |sendemail to=abc message=content