Alerting

Refining alert using per $result.host$ -- How to generate separate alerts per host?

the_wolverine
Champion

I have a need to generate alerts from a single scheduled search:

  • Show me all the events PER HOST matching my condition
  • Send a separate alert PER HOST
  • Email a different user PER HOST

Can this be done without external scripts?

0 Karma

solarboyz1
Builder

Configure the saved search.
Use a lookup in the search, that matches the email recipient to the alert they need to recieve.

Schedule it to alert.
Set alert mode per-result.

Set alert action send email
Set email recipient token from the event as the sendto field.

0 Karma

woodcock
Esteemed Legend

If you need to send a contextually-approrpriate subset of results to some people, you can skip the configuration-based email settings and do this in SPL directly:

... | outputcsv TempFile.csv
| stats values(Email_Address) AS emailToHeader | mvexpand emailToHeader
| map search="|inputcsv TempFile.csv | where Email_Addresss=\"$emailToHeader$\"
   | fields - Email_Address
   | sendemail
      sendresults=true inline=true
      server=\"Your.Value.Here\"
      from=\"Your.Value.Here\"
      to=\"$emailToHeader$\"
      subject=\"Your Subject here: \$name\$\"
      message=\"This report alert was generated by \$app\$ Splunk with this search string: \$search\$\""
| search ThisFieldWillNeverExist="SoThisCommandWillDropAllEventsSoThatYouCanPullInTheOriginalSetWhichYouMightOrMightNotCareToDo"
| appendpipe [|inputcsv TempFile.csv]

The only downside to this approach is that If the search dose not return any results it will produce the following error:

"Error in "map": Did not find value for required attributes 'emailToHeader'

This is "normal" and I have not found a good way to code around it.

0 Karma

jkat54
SplunkTrust
SplunkTrust

you could script this in your search like this:

...|eval sendTo=if(case(host==host1,"user@domain.tld",host==host2,"user2@domain.tld")) | where count>0 | sendemail to=$result.sendTo$ ...

Not certain the sendTo command is correct in my example but it sounds like you can figure it out from there.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...