Alerting

Can we set up conditional alerting to have an alert sent to a certain email based on the search result?

rgoyal1010
New Member

I have logs from autosys (job scheduler) parsed into Splunk. It alerts me if it finds keyword INACTIVE in any of the events based on which I am able to extract the jobname. Is it possible for me to determine the alert subscription based on the output of this jobname?

0 Karma
1 Solution

ryanoconnor
Builder

If you want to do it all in one search, it may not be as straight forward but it's definitely possible.

You'll probably have to use some conditionals and the sendemail command:

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Sendemail

A sample search is below. Obviously you'd have to fit it to your desired output and probably play with it a little bit to get it right.

... | eval email_list = case(X,"jessica@company.com", Y, "joe@company.com,jessica@company.com") |map search="| sendemail to=$email_list$"

View solution in original post

ryanoconnor
Builder

If you want to do it all in one search, it may not be as straight forward but it's definitely possible.

You'll probably have to use some conditionals and the sendemail command:

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Sendemail

A sample search is below. Obviously you'd have to fit it to your desired output and probably play with it a little bit to get it right.

... | eval email_list = case(X,"jessica@company.com", Y, "joe@company.com,jessica@company.com") |map search="| sendemail to=$email_list$"

rgoyal1010
New Member

Will try this out and update if it works.

0 Karma

ryanoconnor
Builder

Are you looking for the search schedule to be based on the job name? Or would it suffice to have a search running regularly and have it alert you on certain intervals based on the job name?

0 Karma

rgoyal1010
New Member

I am able to run search at regular intervals and send alert. What I want is that based on the output of my search result can I determine which email alias would be alerted ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...