i have written splunk query
index=aaa sourcetype=xyz | stats count by xxx
i want to mail only if count greater than 0 to xyz@xyz.com and if count greater than 10 then mail to abcd@xyz.com
Could you please help
index=aaa sourcetype=xyz | stats count as total by xxx |eval a=if(total >0 ,"abc@gmail.com",case(total>10,"xyz@gmail.com")) | sendemail to=$result.a$ format="html" server=smtp.xxx.com:123 use_tls=1 subject="Alert for Data" message="This is an alert data" sendpdf=true
Well I dont know if its gonna help you but you can use a schedule search with |sendemail
command on it, you can make two different searchs and put a | where
conditional for one search up to 0 but less than 10 and another search with greater than 10.
it will be something like this
index=aaa sourcetype=xyz | stats count by xxx
| where count > 0 || count < 10
|sendemail to="emailreceiver@emai.com"
look at this link for more information about sendemail: http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Sendemail
and second search will be like
index=aaa sourcetype=xyz | stats count by xxx
| where count > 10
|sendemail to="emailreceiver@emai.com"
Hope it works, if didn't just tell me if you are making an alert of something else, see ya!! 😉
index=aaa sourcetype=xyz | stats count as total by xxx |eval a=if(total >0 ,"abc@gmail.com",case(total>10,"xyz@gmail.com")) | sendemail to=$result.a$ format="html" server=smtp.xxx.com:123 use_tls=1 subject="Alert for Data" message="This is an alert data" sendpdf=true
thanks for your answer!!