Reporting

Is it possible to send email based on certain condition?

syx093
Communicator

I am trying to send emails based on certain conditions. For example if the host=<host1> the send the email to person1@example.com. If host=<host2> send the email to person2@example.com. If have trying to use the sendemail command but I have not been successful in this attempt.

0 Karma

jeffland
SplunkTrust
SplunkTrust

An alert seems to be exactly what you want to do.
You define a search for host=host1, schedule it to run every five minutes or so, and if it returns results, you send an email to some user. You do that for all alerts you want to receive.

0 Karma

syx093
Communicator

There are about 40 different unique host and mount combination. If I understand what you are suggesting, that would me I would have to create 10 different alerts to get this working.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Oh. Well it is probably possible to do that in an automated fashion as well, maybe via a lookup to determine the adressee and with sendemail. Unfortunately, I don't know how to right off the bat.

0 Karma

syx093
Communicator

That my original approach however the field does not take other fields as an accepted argument. For example, if on of the field is called email, using to=email will make an attempt to send an email to email.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...