<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Using map to sendemail (email body is empty) in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Using-map-to-sendemail-email-body-is-empty/m-p/559394#M158932</link>
    <description>&lt;P&gt;Would like to automatically send an email to all email addresses which are the output of a search. My problem is that Splunk is indeed sending an email to all email addresses, like it should, but the email body is empty in all cases.&amp;nbsp;&lt;/P&gt;&lt;P&gt;This is the query which I use to send the email (the searchquery is above these line's, it's output is user_name, fullname and email):&lt;/P&gt;&lt;P&gt;&lt;EM&gt;|table user_name fullname email&amp;nbsp;&lt;/EM&gt;&lt;BR /&gt;&lt;EM&gt;|map maxsearches=5000 search=" stats count&lt;/EM&gt;&lt;BR /&gt;&lt;EM&gt;|eval email=\"$email$\"&lt;/EM&gt;&lt;BR /&gt;&lt;EM&gt;|eval fullname=\"$fullname$\" &lt;/EM&gt;&lt;BR /&gt;&lt;EM&gt;|table fullname email&amp;nbsp;&lt;/EM&gt;&lt;BR /&gt;&lt;EM&gt;|sendemail to=$result.email$&amp;nbsp; subject="Subject" &lt;/EM&gt;&lt;EM&gt;message=\"Dear colleague,&amp;nbsp;&lt;/EM&gt;&lt;I&gt;XXXXXX&amp;nbsp;&lt;/I&gt;&lt;EM&gt;Kind regards,&amp;nbsp;&lt;/EM&gt;&lt;EM&gt;Tim\" &lt;/EM&gt;&lt;EM&gt;sendresults=true inline=true"&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;The query was created by a colleague of mine, who I can't ask for help anymore since he moved to a different company. Not sure what's wrong with this query. I tried to search the Splunk community and net, but was not able to come up with a solution by myself.&lt;/P&gt;</description>
    <pubDate>Wed, 14 Jul 2021 10:56:00 GMT</pubDate>
    <dc:creator>Tim00</dc:creator>
    <dc:date>2021-07-14T10:56:00Z</dc:date>
    <item>
      <title>Using map to sendemail (email body is empty)</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Using-map-to-sendemail-email-body-is-empty/m-p/559394#M158932</link>
      <description>&lt;P&gt;Would like to automatically send an email to all email addresses which are the output of a search. My problem is that Splunk is indeed sending an email to all email addresses, like it should, but the email body is empty in all cases.&amp;nbsp;&lt;/P&gt;&lt;P&gt;This is the query which I use to send the email (the searchquery is above these line's, it's output is user_name, fullname and email):&lt;/P&gt;&lt;P&gt;&lt;EM&gt;|table user_name fullname email&amp;nbsp;&lt;/EM&gt;&lt;BR /&gt;&lt;EM&gt;|map maxsearches=5000 search=" stats count&lt;/EM&gt;&lt;BR /&gt;&lt;EM&gt;|eval email=\"$email$\"&lt;/EM&gt;&lt;BR /&gt;&lt;EM&gt;|eval fullname=\"$fullname$\" &lt;/EM&gt;&lt;BR /&gt;&lt;EM&gt;|table fullname email&amp;nbsp;&lt;/EM&gt;&lt;BR /&gt;&lt;EM&gt;|sendemail to=$result.email$&amp;nbsp; subject="Subject" &lt;/EM&gt;&lt;EM&gt;message=\"Dear colleague,&amp;nbsp;&lt;/EM&gt;&lt;I&gt;XXXXXX&amp;nbsp;&lt;/I&gt;&lt;EM&gt;Kind regards,&amp;nbsp;&lt;/EM&gt;&lt;EM&gt;Tim\" &lt;/EM&gt;&lt;EM&gt;sendresults=true inline=true"&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;The query was created by a colleague of mine, who I can't ask for help anymore since he moved to a different company. Not sure what's wrong with this query. I tried to search the Splunk community and net, but was not able to come up with a solution by myself.&lt;/P&gt;</description>
      <pubDate>Wed, 14 Jul 2021 10:56:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Using-map-to-sendemail-email-body-is-empty/m-p/559394#M158932</guid>
      <dc:creator>Tim00</dc:creator>
      <dc:date>2021-07-14T10:56:00Z</dc:date>
    </item>
  </channel>
</rss>

