topic Re: How to send individual emails that appear in the search results in Splunk Search

How to send individual emails that appear in the search results

pavaninpdl — Mon, 30 Apr 2018 11:11:38 GMT

Hi team,

I have search results with CUID is the email(I will append my company domain to CUID, so that mail will go to person) and attached the sample result for the same .How to send the individual emails for all the users along with server name.

I have used send mail command , but it is sending only one mail to the user appear in the first result. I need to send mail to all the users that appears in the list.

Please help me on this.

Re: How to send individual emails that appear in the search results

pradeepkumarg — Mon, 30 Apr 2018 17:48:08 GMT

Did you try the map command?,

Look at below answer
https://answers.splunk.com/answers/627366/sending-emails-to-users-that-appear-in-search-resu.html

Re: How to send individual emails that appear in the search results

somesoni2 — Mon, 30 Apr 2018 17:55:05 GMT

You can use the map command along with the sendemail command, like this

your current search with all the fields mentioned in the screenshot
| map maxsearch=1000 search="| gentimes start=-1 | eval HOSTNM=\"$HOSTNM$\" |..other fields | sendmail to=\"$CUID$\" ..."

Re: How to send individual emails that appear in the search results

woodcock — Mon, 30 Apr 2018 18:39:22 GMT

This is from another Q&A:
https://answers.splunk.com/answers/399434/send-emailed-results-to-an-email-address-in-the-re.html#answer-399515

If you need to send a contextually-appropriate subset of results to some people, you can skip the configuration-based email settings and do this in SPL:

... | outputcsv TempFile.csv
| stats values(Email_Address) AS emailToHeader | mvexpand emailToHeader
| map search ="|inputcsv TempFile.csv | where Email_Addresss=\"$emailToHeader$\"
   | fields - Email_Address
   | sendemail
      sendresults=true inline=true
      server=\"Your.Value.Here\"
      from=\"Your.Value.Here\"
      to=\"$emailToHeader$\"
      subject=\"Your Subject here: \$name\$\"
      message=\"This report alert was generated by \$app\$ Splunk with this search string: \$search\$\""
| where comment="MakeSureNoEventsRemail"
| append [|inputcsv TempFile.csv]

Re: How to send individual emails that appear in the search results

sirajnp — Wed, 30 Jun 2021 07:42:57 GMT

It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result.

https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_recipients_based_on_search_results