Alert Sending Email based on Value of a field

[ifeldshteyn]

I have saved a field in the result that is called Email. If in my search that field is present I want to send an email to that email. Is that possible to do in an alert?

So if in the results the field Email equals bob@bobsworld.com, the search will send an email to this bob with a certain message.

Also if would be great if you could send to more than one user based on how many Fields are there.

So if there are two results in the search, one Field equals nancy@bobsworld.com and the other bob@bobsworld.com then an email s would be sent to each one of them.

Complicated? Or is there a possible solution?

If not, is it possible to start a script with the inputs of the values of the fields and I will do the sending in the script?

Thanks.

[Ledion_Bitincka · Accepted solution]

Short answer: no, Splunk cannot do that by default. However you should be able to write a custom search command that does what you're looking for. Alternatively you can also call and external script that does the work using the script search command script