https://community.splunk.com/t5/Splunk-Dev/Sendemail-using-Python-SDK/m-p/403798#M6937 <P>I am trying to run the following search using Splunk python sdk. It returns the results but does not send the EMAIL as it does if i run the same search using the Splunk UI.</P> <PRE><CODE>searchquery_normal = 'search * earliest="8/26/2013:23:40:00" latest="8/26/2013:23:55:00" index=os host=* sourcetype=cpu | lookup chipot fqdn as host | search application_name="New App*" AND physical_environment_name="Production*" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |eval cpu=100-pctIdle|stats avg(cpu) by host,application_name|rename avg(cpu) as cpualert|where cpualert &gt;20|sort "application_name"|sendemail to="myemailid@domain.com" format=html subject=ALERT_CPU_sentfromPython sendresults=true' </CODE></PRE> Tue, 27 Aug 2013 18:32:07 GMT sunilsk1 2013-08-27T18:32:07Z https://community.splunk.com/t5/Splunk-Dev/Sendemail-using-Python-SDK/m-p/403798#M6937 <P>I am trying to run the following search using Splunk python sdk. It returns the results but does not send the EMAIL as it does if i run the same search using the Splunk UI.</P> <PRE><CODE>searchquery_normal = 'search * earliest="8/26/2013:23:40:00" latest="8/26/2013:23:55:00" index=os host=* sourcetype=cpu | lookup chipot fqdn as host | search application_name="New App*" AND physical_environment_name="Production*" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |eval cpu=100-pctIdle|stats avg(cpu) by host,application_name|rename avg(cpu) as cpualert|where cpualert &gt;20|sort "application_name"|sendemail to="myemailid@domain.com" format=html subject=ALERT_CPU_sentfromPython sendresults=true' </CODE></PRE> Tue, 27 Aug 2013 18:32:07 GMT https://community.splunk.com/t5/Splunk-Dev/Sendemail-using-Python-SDK/m-p/403798#M6937 sunilsk1 2013-08-27T18:32:07Z https://community.splunk.com/t5/Splunk-Dev/Sendemail-using-Python-SDK/m-p/403799#M6938 <P>What app context are you executing the search with in both scenarios? Alert_actions.conf can be app specific so that one app uses one mail server and settings yet another app can use a different mail server and settings.</P> <P>So if you have your email configured via alert_actions in yourAppName but you’re executing search from servicesNS/-/- or etc... this could be the cause for the descrepancy.</P> Tue, 27 Nov 2018 01:37:10 GMT https://community.splunk.com/t5/Splunk-Dev/Sendemail-using-Python-SDK/m-p/403799#M6938 jkat54 2018-11-27T01:37:10Z