Sending Alert email to the extracted user field

[zacksoft]

I have set up alerts in Splunk and usually I hard-code the recipients email id in the TO field, and it works flawlessly.
But in this case , I cannot hardcode the user email id in the alert's TO field, because the user ID has to be extracted from the event (from the event that satisfies the alert condition).

Example (sample event that will satisfy the alert query):

40.145.234.438 329x399740x1 PERSON1 [09/Mar/2020:05:29:23 -0400] "DELETE /rest/api/2/issue/TES1-2/butchers?username=PERSON2 HTTP/1.1" 204 - 40 "https://phutan-dev.mayhem.com/browse/RES1-2" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36" "1k35v6f"

IF the word butcher is identified then the event should be picked (I can handle until this) and from the event extract PERSON1 and PERSON2 field and trigger email to these two PERSONS as PERSON1@mayhem.com. PERSON2@mayhem.com through the alert.

I have extracted PERSON1 and PERSON2 from the event. I'm just looking to append @mayhem.com to them and trigger alert emails to these two persons only.

[manjunathmeti · Accepted solution]

Use result token $result.fieldname$. First value for the specified field name from the first search result row is used.

In the To field, set value like this. Here PERSON1 and PERSON2 are field names.

$result.PERSON1$@mayhem.com,$result.PERSON2$@mayhem.com

If each row has different values for fields PERSON1 and PERSON2 then set Trigger settings to for each result in Edit alert page.