Sendemail command email body

Poojitha — Tue, 02 Jan 2024 21:04:33 GMT

Hi All,

I am using send email command to send csv file to different recepients based on the search .

| eval subject="This is test subject" ,email_body= "This is test email body" | map search="|inputcsv test.csv | where owner=\"$email$\" | sendemail sendcsv=true to=\"$email$\" subject=\"$subject$\" message="\$email_body$\""

I want email body as "This is test email body". Instead I am getting "Search Results attached". I understand message depend on the arguments passed. As I am passing sendcsv=true, I am getting this. I am using sendcsv as I am sending results as attachment(csv file). Please let me know how can I pass custom message to email body.

Regards,
PNV

Re: Sendemail command email body

inventsekar — Wed, 03 Jan 2024 05:04:22 GMT

Hi @Poojitha
I think this looks like a the msg token issue.

Could you pls try this:

|makeresults |eval custommessage="sample sendemail message body" |eval dest="mailid@domain.com" |sendemail to="$result.dest$" message="$result.custommessage$"

then check if the message body appears as you are expecting.

more details:

https://docs.splunk.com/Documentation/Splunk/9.1.2/SearchReference/sendemail

https://docs.splunk.com/Documentation/Splunk/9.1.2/Alert/EmailNotificationTokens

upvotes / karma points are appreciated, thanks.

topic Sendemail command email body in Splunk Enterprise Security

Sendemail command email body

Re: Sendemail command email body