How to send email to multi users one by one

chlily — Thu, 09 Mar 2017 00:34:51 GMT

I run a query and get the table like this,

user user_email content
Jack jack@abc.com abcmdsfsadfsadfsadfsdf
Mike Mike@abc.com suiyeworuiweourwqoerw

And I want to use command "sendmail" to send email to each user and the message is the content value. But looks like only the first user "Jack" can receive the email, Mike can't. Can you please shed a light, how to send email to multi users one by one?

sendemail to=$result.user_email$ from="boos@abc.com" subject="This is testing!" message="Hi, it's your content $result.content$." sendresults=true inline=true format=raw

Re: How to send email to multi users one by one

woodcock — Thu, 09 Mar 2017 00:46:04 GMT

This is from another Q&A:
https://answers.splunk.com/answers/399434/send-emailed-results-to-an-email-address-in-the-re.html#answer-399515

If you need to send a contextually-appropriate subset of results to some people, you can skip the configuration-based email settings and do this in SPL:

... | outputcsv TempFile.csv
| stats values(Email_Address) AS emailToHeader | mvexpand emailToHeader
| map search ="|inputcsv TempFile.csv | where Email_Addresss=\"$emailToHeader$\"
   | fields - Email_Address
   | sendemail
      sendresults=true inline=true
      server=\"Your.Value.Here\"
      from=\"Your.Value.Here\"
      to=\"$emailToHeader$\"
      subject=\"Your Subject here: \$name\$\"
      message=\"This report alert was generated by \$app\$ Splunk with this search string: \$search\$\""
| where comment="MakeSureNoEventsRemail"
| append [|inputcsv TempFile.csv]

topic Re: How to send email to multi users one by one in Splunk Search

How to send email to multi users one by one

Re: How to send email to multi users one by one