Splunk Search

How to send alerts to multiple emails based on lookup table match on host owners?

tmaltizo
Path Finder

We currently have a lookup table with hosts and their respective owner email.

host ; host owner email
ABCD1234 ; ABCD1234Dist@emailadd.com
XYZ123 ; XYZ123Dist@emailadd.com

We'd like to trigger email alerts if any host becomes non-compliant by the 6th day to warn the owners to remediate the issues before they get on the 7th-day non-compliant report. Given, that the two sample hosts above meet this condition, how would we incorporate this logic into the email alerting, if not through the alert wizard?

Thanks for any help!
Trista

0 Karma

woodcock
Esteemed Legend

You will need these commands:

stats, map, and sendemail

If you give more logic and example searches, then people will give more specific answers.

0 Karma

jimodonald
Contributor

I think the "sendemail" command is what you're looking for.

https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Sendemail

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...