Alerting

How to send specific set of data to specific recipient?

ASISH_9
Engager

Hello,
I have a set of data in the following manner.

Domain Application TicketId Hours Recipient
HR abb 123rrr 121 h1@gmail.com
HR hhg 145rew 100 h1@gmail.com
Hi aby 123rrt 120 h2@gmail.com
Hi hhu 145rty 109 h2@gmail.com
Hl abo 123rhg 127 h3@gmail.com
Hl hhi 145rll 105 h3@gmail.com
Hl abp 123rkh 123 h3@gmail.com
Tm hhp 145rfdf 100 h4@gmail.com

The query which i have written generates this:
"search query|eval recipient=case(Domain=HR,recipient=h1@gmail.com,Domain=Hi,recipient=h2@gmail.com,Domain=Hl,recipient=h3@gmail.com)|"
so that it sends specific data to specific recipients as mail alerts.
Like If domain is HR then all data related to hr should go to h1@gmail.com not the data of remaining domains.
In my mail alerts settings also alert mode="once per search" mode and in the TO filed it is $recipient.result$ , but still mail is not sending specific results to specific recipients.It is sending the whole data

Please suggest what should be done

Tags (1)
0 Karma

somesoni2
Revered Legend

You need to select alert mode as once per result. Be aware that with your current search, it may send duplicate alerts if there are multiple records for each email address. To avoid that you can do like this

your current query generating above output | stats list(*) as * by Recipient

Also, the to field should be $result.recipient$ Is that a typo in your post?

ASISH_9
Engager

Thanks this worked
But now the problem is the mail is not sent in a organised format.
like i was expecting:
recipient Domain Application

h1@gmail.com HR abc

HR hhg

rather it came in this way
recipient Domain Application
h1@gmail.com HR HR abc hhg

can we bring the table in first format?

0 Karma

cmerriman
Super Champion

try this eval:

|eval recipient=case(Domain="HR","h1@gmail.com",Domain="Hi","h2@gmail.com",Domain="Hl","h3@gmail.com")

and see if that works.
and in the TO field: $result.recipient$

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...