Reporting

Is it possible to send email based on certain condition?

syx093
Communicator

I am trying to send emails based on certain conditions. For example if the host=<host1> the send the email to person1@example.com. If host=<host2> send the email to person2@example.com. If have trying to use the sendemail command but I have not been successful in this attempt.

0 Karma

jeffland
SplunkTrust
SplunkTrust

An alert seems to be exactly what you want to do.
You define a search for host=host1, schedule it to run every five minutes or so, and if it returns results, you send an email to some user. You do that for all alerts you want to receive.

0 Karma

syx093
Communicator

There are about 40 different unique host and mount combination. If I understand what you are suggesting, that would me I would have to create 10 different alerts to get this working.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Oh. Well it is probably possible to do that in an automated fashion as well, maybe via a lookup to determine the adressee and with sendemail. Unfortunately, I don't know how to right off the bat.

0 Karma

syx093
Communicator

That my original approach however the field does not take other fields as an accepted argument. For example, if on of the field is called email, using to=email will make an attempt to send an email to email.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...