topic Re: sendMail "From= " in Splunk Enterprise

sendMail "From= "

alvesri — Wed, 13 Mar 2024 09:50:21 GMT

Hi guys,

Thank you in advance,

Is it possible to use a value of the search result as a parameter in the |sendmail from=" ? "

In the | sendmail to="we can use results.mail_to" but in case of | sendmail from="results.mail_from" don't work.

We already disable the security options for this.

like for example

ndex="main" | eval mail_from = "username@mail.com" | eval mail_to = "username@mail.com" | eval subject = "subject" | table username age country city | sendemail to=$result.mail_to$ from= $result_mail_from$ subject=$results.subject$ message="This is an example message" sendresults=true inline=true format=table sendcsv=true

Re: sendMail "From= "

isoutamo — Wed, 13 Mar 2024 12:55:08 GMT

you must use valid email address on from field. Currently most email servers require that those senders must be within valid and permitted domains. Depending on your configuration it could be that you can use only that from field and user which are configured into your splunk and given by email provider.

r. Ismo

Re: sendMail "From= "

kartm2020 — Thu, 14 Mar 2024 06:35:03 GMT

Hi,

Can you please use the mail server parameter with the email ID as mentioned in the below docs.

server="server info"

https://docs.splunk.com/Documentation/Splunk/8.1.0/Alert/Emailnotification