topic Re: sending email with search in Splunk Dev

sending email with search

yashaswinig2210 — Thu, 11 Feb 2021 12:40:59 GMT

Hi,

I have a query which sends email based on the result and is scheduled for every 5mins.Below is the search

|mysearch | table Owner, AccountName,Machine
| outputcsv Account.csv
| map search="
       |inputcsv Account.csv
       | table Owner, AccountName,Machine|where Owner=\"$Owner$\"
       |sendemail
       sendresults=true inline=true
       from=\"abc@gmail.com\"
       to=\"$Owner$\"
       subject=\"$AccountName$ \""

this is sending email to the owner every 5mins , my want is the email should be triggered to owner only when it is not triggered in last 24hrs even it is scheduled for 5mins based on the AccountName.

can we use throttling in this case or Could you please provide me a solution.

Re: sending email with search

richgalloway — Thu, 11 Feb 2021 14:03:21 GMT

Yes, use throttling.

Re: sending email with search

yashaswinig2210 — Thu, 11 Feb 2021 14:33:42 GMT

Could you please tell how can we give throttling and suppression values within the query as the mail is being triggered from the query itself

Re: sending email with search

richgalloway — Thu, 11 Feb 2021 18:42:49 GMT

Ah, sorry, I thought we were talking about alerts. There is no throttling within search. Perhaps you could convert this into an alert?

Re: sending email with search

yashaswinig2210 — Mon, 15 Feb 2021 06:53:13 GMT

In this case my email should be sent to the owner of the account which im getting from the query itself, is there any way to pass field value from the query to send an email from alerts?