topic Re: Is it possible to change the table fields being sent with the sendemail command? in Splunk Search

Is it possible to change the table fields being sent with the sendemail command?

andrewtrobec — Fri, 04 Aug 2017 13:23:05 GMT

Hello,

I'm trying to find a way to use search result fields to address an e-mail, but remove those fields in the inline table in the body of the e-mail.

Here is an example of the search results:

Field_1, Field_2, Contact
Value_F1_1, Value_F2_2, contact@domain.com
Value_F1_2, Value_F2_3, contact@domain.com
Value_F1_3, Value_F2_2, contact@domain.com

The send e-mail command I am using needs the Contact field to determine who to send the e-mail to:

... |sendemail to=$result.Contact$ subject=subject sendresults=true format=table

As you can imagine, the inline table in the e-mail contains the Contact field as well. What I'd like to know is whether there is some way to remove the field from the inline table sent in the e-mail.

Thank you and best regards,

Andrew

Re: Is it possible to change the table fields being sent with the sendemail command?

sbbadri — Fri, 04 Aug 2017 14:29:41 GMT

try this,

 ... | fields Contact |sendemail to=$result.Contact$ subject=subject sendresults=true format=table

Re: Is it possible to change the table fields being sent with the sendemail command?

andrewtrobec — Fri, 04 Aug 2017 14:37:52 GMT

Thanks for the reply. This suggestion does the opposite of what I'm looking for: it sends an e-mail to the address and the e-mail content is just the contact column. I'd like to send an e-mail to the address, but have the inline table contain everything but the contact field.

Re: Is it possible to change the table fields being sent with the sendemail command?

sbbadri — Fri, 04 Aug 2017 15:39:28 GMT

... | fields - Contact |sendemail to=$result.Contact$ subject=subject sendresults=true format=table

Re: Is it possible to change the table fields being sent with the sendemail command?

niketn — Fri, 04 Aug 2017 16:40:28 GMT

@andrewtrobec, what is the query that fetches the results above? Also how many rows do you expect in results?

Re: Is it possible to change the table fields being sent with the sendemail command?

andrewtrobec — Fri, 04 Aug 2017 17:49:44 GMT

I have an index that has those values already, so it would be

index=my_index | table Field_1 Field_2 Contact

There are filters in place that will make sure that Contact will be the same for every event. There will be between 2 and 25/30 results. I want to be able to send an e-mail to Contact, but configure the body so that the Contact field doesn't appear.

Re: Is it possible to change the table fields being sent with the sendemail command?

andrewtrobec — Fri, 04 Aug 2017 17:56:59 GMT

I've also tried this, but it removes the field so there is nothing to pass to the sendmail command. Thanks for trying!

Re: Is it possible to change the table fields being sent with the sendemail command?

Rohit_K — Wed, 20 Sep 2023 11:13:04 GMT

Hi,

You might have got the result i am replying so that it can help others

as you are using sendemail command and you need Contact field do the following

...|rename Contact as _Contact |sendemail to=$result._Contact$ subject=subject sendresults=true format=table

while sending mail splunk will ignore _Contatct field as it has underscore(_)

Hope this helps

Happy Splunking 🙂