Splunk Search

How to put the result of an additional search into an alert email triggered by the base search?

SY715
Explorer

Hi

Is there any way to put the search result of additional search into the alert mail triggered by the base search?
For example, following two search strings will get totally different results from different source types.

search strings A : the result shows the number of errors in source type A
search strings B : the result shows the number of users in source type B

Now, I'd like to distribute an alert e-mail when the result of search string A meets certain condition (like >5 ), then submit the search strings B simultaneously and put the result of B into that alert e-mail. The search strings A is the based search that is scheduled every 1 minute to make a trigger for e-mail alert. On the other hand, the search strings B is the additional search that should be submitted only when the trigger is created and to make a result put in e-mail alert.

According to the splunk documentation, only the result of the original search could be put in the alert e-mail. So I'd like to know whether I could put the result of search B in the alert e-mail instead of A.

The important point is that I'd like the search strings B to be submitted only when the trigger is created in order to save the power of splunk. There might be a way to search both A and B as the based search but that seems to use a lot of power.

The ideal is putting the result of search B into the alert e-mail body, but attaching PDF or any other way than RSS is fine.

Tags (3)
0 Karma
1 Solution

vinitatsky
Communicator

You can do this by
1) Create an alert for base search using search string A.
2) Trigger a script (perl or python) whenever above alert is triggered.
3) In the script - You can perform a Splunk search using String B and send an email also.
http://dev.splunk.com/view/python-sdk/SP-CAAAEFK#explorer

There are serveral ways of calling search from the script. i.e. using curl command, using RESP APIs.
Just an example -
curl --write-out "%{http_code}" -u : -k https://localhost:8089/services/search/jobs/export --data-urlencode search="search " -d output_mode=json -d earliest="rt-5m" -d latest="rt"

View solution in original post

vinitatsky
Communicator

You can do this by
1) Create an alert for base search using search string A.
2) Trigger a script (perl or python) whenever above alert is triggered.
3) In the script - You can perform a Splunk search using String B and send an email also.
http://dev.splunk.com/view/python-sdk/SP-CAAAEFK#explorer

There are serveral ways of calling search from the script. i.e. using curl command, using RESP APIs.
Just an example -
curl --write-out "%{http_code}" -u : -k https://localhost:8089/services/search/jobs/export --data-urlencode search="search " -d output_mode=json -d earliest="rt-5m" -d latest="rt"

SY715
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...