topic sending emails to users that appear in search results in Splunk Search

sending emails to users that appear in search results

AssafLowenstein — Thu, 15 Mar 2018 13:52:23 GMT

Hi,

The question was asked before but I couldn't find a good answer anywhere. Here goes...
I have a search result with multiple lines and the first column consists of emails of different persons that I need email.
The rest of the columns also have information that needs to be included in the email. the information is different for each person/row.

How can I send multiple emails to different recipients using sendmail with the recipient being the name in the first column and the email itself has information from the rest of the columns.

Thanks.
Assaf

Re: sending emails to users that appear in search results

elliotproebstel — Thu, 15 Mar 2018 14:35:32 GMT

Let's say your search results return fields named recipient, data1, data2, and data3, and you'd like to send the contents of the fields named data* to the user named in the recipient field. Here's how you'd do that:

your base search
| map search 
 [ | sendemail to=$recipient$ subject="some subject" from=youremail@yourself.com message="$data1$ and then more $data2$ and finally some $data3$" ]

This will run the subsearch once for each line of results from the base search, effectively shepherding the values from recipient and data* into the subsearch together.

Re: sending emails to users that appear in search results

AssafLowenstein — Tue, 29 Sep 2020 18:33:58 GMT

Thanks elliotproebstel,
when running your suggestion as is Splunk threw an error but some digging got me to the correct syntax (Adding it below for future referencing)

base_search
| map search="sendemail to= subject=\"need_to_escape\" from= message=\"$data1$ and then more $data2$ and finally some $data3$\" sendresults=true inline=true format=raw"

Thanks, accepting as answer.

Re: sending emails to users that appear in search results

gjanders — Mon, 19 Mar 2018 11:05:51 GMT

While you already have an answer, I'd suggest you also have a look at sendresults, this can be useful for emailing the results of a search on a per-user basis...

Re: sending emails to users that appear in search results

AssafLowenstein — Mon, 19 Mar 2018 14:25:13 GMT

Thanks.. I'll look into that also.

Re: sending emails to users that appear in search results

sirajnp — Wed, 30 Jun 2021 07:41:18 GMT

It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result.

https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_recipients_based_on_search_results