Variable reference in To: field of an email alert.

[mdzmuran]

Hi Splunk Team.

Can I use variable reference in To: field of an email alert? I have a distribution_list variable associated with my sourcetype and it is set to correct email address depending on date and time.  

U put $result.distribution_list$ in the To: field, but it does not send email.

Thanks

Michal

[venkatasri]

Hi @mdzmuran 

Yes you can use $result.distribution_list$ format in TO: field, however the search results should be having the value populated to distribution_list field, did you verify it?

How are you so sure email not been sent just checking the inbox ? Sometimes the Splunk user has been restricted to schedule alerts. Can you run following query to find out errors associated to your alert?

index=_internal source=*scheduler.log ERROR OR WARN

 To find send email errors,

index=_internal source=*python.log sendemail ERROR OR WARN

Hope mail server already configured in Splunk.

---

An upvote would be appreciated and Accept solution if this reply helps!

[venkatasri]

An upvote would be appreciated and Accept solution if this reply helps!

[mdzmuran]

HIi venkatasri.

The alerts are triggered, I can see them in Triggered alerts.

If I replace $result.distribution_list$ with regular email address, the emails are sent.

The queries suggested do not return any data. It may be due to access permissions, I asked administrators to run them.

One more info, it may be important. The distribution_list variable is not defined in the search query. It is defined in the Calculated Fields setting for this particular sourcetype. I can see it, however, in the search results if I run the alert query manually.

Michal

[venkatasri]

@mdzmuran 

As per docs the field shall be explicitly available in results.  Try including distribution_list to results using | fields command. Hope this helps!

$result.fieldname$

First value for the specified field name from the first search result row. Verify that the search generates the field being accessed.