topic Re: How to send report to different user based on SPLUNK query in Reporting

How to send report to different user based on SPLUNK query

twtyj — Tue, 29 Sep 2020 20:10:59 GMT

I have a SPLUNK query that generate following table:

User_Name Number recipient
user_a 10 user_a@mail.com
user_b 20 user_b@mail.com
user_c 30 user_c@mail.com

how can i achieve for each recipient only receive email contains its records? like user_a@mail.com only receive following:
User_Name Number
user_a 10

Thanks.

Re: How to send report to different user based on SPLUNK query

Sukisen1981 — Thu, 28 Jun 2018 11:44:29 GMT

Hi, yo ucan sort of roundabout implement this through alerts

http://docs.splunk.com/Documentation/Splunk/7.1.1/Alert/Emailnotification
This allows you to pass the To field dynamically through the $result.recipient$ token
Now,assuming that there is only 1 unique row per email address, you can set up an alert to run for each search result AND pass the 'TO' email address dynamically. I am sure you have access to the alert documentation, it is worth a try

Re: How to send report to different user based on SPLUNK query

gjanders — Fri, 29 Jun 2018 01:17:31 GMT

sendresults may help here

Re: How to send report to different user based on SPLUNK query

MuS — Fri, 29 Jun 2018 01:29:42 GMT

Indeed this is the right command to do such a thing, here is an example :

Base search here 
| map search="| sendemail to=$recipient$ subject="words here" from=splunk@company.com message="We have this $Number$ for you""

Here are more examples https://answers.splunk.com/answers/186045/how-can-i-use-a-combination-of-map-and-sendemail-t.html

cheers, MuS

Re: How to send report to different user based on SPLUNK query

twtyj — Fri, 29 Jun 2018 02:42:42 GMT

Hi Mus,

I try your query but failed, the result is empty.

Re: How to send report to different user based on SPLUNK query

woodcock — Sat, 30 Jun 2018 15:38:52 GMT

This is from another Q&A:
https://answers.splunk.com/answers/399434/send-emailed-results-to-an-email-address-in-the-re.html#answer-399515

If you need to send a contextually-appropriate subset of results to some people, you can skip the configuration-based email settings and do this in SPL:

... | outputlookup TempFile.csv
| stats values(Email_Address) AS emailToHeader | mvexpand emailToHeader
| map search ="|inputcsv TempFile.csv | where Email_Addresss=\"$emailToHeader$\"
   | fields - Email_Address
   | sendemail
      sendresults=true inline=true
      server=\"Your.Value.Here\"
      from=\"Your.Value.Here\"
      to=\"$emailToHeader$\"
      subject=\"Your Subject here: \$name\$\"
      message=\"This report alert was generated by \$app\$ Splunk with this search string: \$search\$\""
| where comment="MakeSureNoEventsRemail"
| append [|inputlookup TempFile.csv]

Re: How to send report to different user based on SPLUNK query

MuS — Mon, 02 Jul 2018 00:58:20 GMT

Hi there, well you need to adapt the example to match your fields in the events 😉

cheers, MuS