Can I use a lookup table of email addresses that receive an alert?

[Cyril31200]

Hello,

Could you please tell me if it is possible to provide an email distribution list from a lookup table to a Splunk Alert which send email ?
In other words, could I used search results (lookup table) to provide a list of email adresse to an Alert ?

Thanks by advance,

Cyril

[woodcock]

You can't do it in the alert but you can do it in the SPL. See my (admitted-to-work yet somehow still unaccepted) answer in this Q&A:

https://answers.splunk.com/answers/401081/how-to-use-the-sendemail-command-to-send-an-email.html

It says basically this (you just need to integrate your extra lookup into the solution):

This is from another Q&A:
https://answers.splunk.com/answers/399434/send-emailed-results-to-an-email-address-in-the-re.html#an...

If you need to send a contextually-appropriate subset of results to some people, you can skip the configuration-based email settings and do this in SPL:

... | outputcsv TempFile.csv
| stats values(Email_Address) AS emailToHeader | mvexpand emailToHeader
| map search ="|inputcsv TempFile.csv | where Email_Addresss=\"$emailToHeader$\"
   | fields - Email_Address
   | sendemail
      sendresults=true inline=true
      server=\"Your.Value.Here\"
      from=\"Your.Value.Here\"
      to=\"$emailToHeader$\"
      subject=\"Your Subject here: \$name\$\"
      message=\"This report alert was generated by \$app\$ Splunk with this search string: \$search\$\""
| where comment="MakeSureNoEventsRemail"
| append [|inputcsv TempFile.csv]

[woodcock]

@Cyril31200 if this worked for you, please click Accept to close the question and make it easier for others to find valid solutions.