I need to send an Email based on a if condition. Something like "if (value > 10) send an email". But I am not able to figure out how to do this.
I am trying this with eval. But this only assigns the value to a variable(LoginQuality).
"eval LoginQuality= if (AverageLoginTime >10, "More", "Less")".
I need to make change/modify this statement to send an email depending on the condition.
Can someone help me with this?
Under Manager/Searches and Reports you can schedule your e-mails. This is a feature that veries quite a bit between version. The later versions have better control over this.
answered 25 May '12, 05:55
If I understand your goal here, it's possible that an "advanced conditional alert" will suit your needs. Check out http://docs.splunk.com/Documentation/Splunk/4.2.3/User/SchedulingSavedSearches and search for the section "Define an advanced conditional alert".
I think that using a conditional alert of the form
should get you close to what you want...
answered 29 May '12, 07:01
You can do this with a sub search. Check this out:
index="_internal" group="per_source_thruput" | search series!="_audit" | search series!="_internal" | eval GB=(kb/1024)/1024 | stats sum(GB) as Hourly_Indexed_GB | eval test=if(Hourly_Indexed_GB > 20.3 ,[| search index="_internal" group="per_source_thruput" | search series!="_audit" | search series!="_internal" | eval GB=(kb/1024)/1024 | stats sum(GB) as GB | table GB | sendemail to="email@example.com" format=html subject=Splunk_License_warn server=Your_Mail_Server sendresults=true],"0" )
answered 07 Sep '12, 10:59