Sending Multiple Alerts Based Upon Multiple Conditions Using One Alert In Splunk

Sending Multiple Alerts Based Upon Multiple Conditions Using One Alert In Splunk

Hello Everyone !!

We know that we can create different knowledge objects in Splunk like Dashboards, Alerts, Reports, etc. But we will talk about new and interesting tricks regarding alert.

Now, when we create any alert in Splunk we can specify only one condition according to that condition alert works and we can also send the alert result to specific email id(s).

But have you ever tried to send multiple alerts based upon on multiple conditions using one alert ???? 

Probably not right !!!!

Today we will show you how to achieve that thing. This topic is very new in the context of Splunk. Hope you will enjoy this topic. See the below steps to achieve this thing.

Step:1

Login to your Splunk with the credentials and go to Search & Reporting app.

Step:2

I will show you the alert on some dummy data. The query we have used to create the data is given below,

| makeresults | eval a="200,maityayan1996@gmail.com/300,saradamajumder3@gmail.com/400,bubaimaity00000@gmail.com" , a=split(a,"/") | mvexpand a | table a | makemv delim="," a| eval status=mvindex(a,0) , email=mvindex(a,1) | fields - a

Step:3

Now create an alert with this result set.

Step:4

Now do the following.

I have given a name to this alert as Alert For Multiple Condition and schedule it for every two minutes.

Now, you have to specify For each result in Trigger option. That means it will trigger one time for each and every row in the result set.

Now, in Add Actions option first click on “Add to Triggered Alert”.

After that click on “send email” option from Add Actions. Then here in “to” option You have to give $result.email$ which will call respected email for the each and every row. Also we have added in the subject as ” trigger for http status $result.status$” which will notify us that for which status value the alert is triggering . Then just save the alert. Here email and status are two existing fields of result set which we used with the alert tokens .

Step:5
Now we will check in the mentioned email ids that the alert is sent or not.
For that, just go to the email id and check with the alert name.
You can see the alert is sent to all the email id present in the result set.

Now , just see the below screenshot. When the alert triggered, the results are sent to the  three different email ids . Because the alert is triggered base on the specific condition(status field) and the alert is sent to the specific email ids based upon their condition.

Hope from the next time if you want to send alert to different different peoples depending upon multiple conditions using one alert then you can try this one.

Happy Splunking !!