topic Re: Edit CSV file sent through sendemail command in Splunk Search

Edit CSV file sent through sendemail command

Poojitha — Tue, 19 Dec 2023 11:18:57 GMT

Hi All,

I am trying to send email using sendemail command with csv as an attachment . Email is getting sent successfully but file is getting named as "unknown-<date_time>". I want to rename this file. Please let me know how we are doing this.

| sendemail sendresults=true format=csv to=\"$email$\" graceful=false message="This is a test email" subject="Test Email Check"

Also , message and subject is getting truncated. I am getting message body as "This" and Subject as "Test".
Please help me to know what is going wrong.

Help on :
Renaming the csv file.
How to avoid message body and subject getting truncated.

I really appreciate your help on this

Regards,
PNV

Re: Edit CSV file sent through sendemail command

isoutamo — Fri, 05 Jan 2024 14:12:50 GMT

this should work as expected and documented. Only thing is what you have on $email$ and where you have set it? And where you are calling this partially SPL?

I suppose that this csv file prefix is fixed and you cannot change it?

r. Ismo

Re: Edit CSV file sent through sendemail command

PickleRick — Fri, 05 Jan 2024 14:17:48 GMT

First thing to verify would be to check your _internal logs for the sendemail.py activity and see whether it reports sending the email with the full subject (you won't see the message contents in the log) or truncated one. This way you'll know if it's something between Splunk and the sendemail.py script or is it something in sendemail.py/between it and your email server.

Re: Edit CSV file sent through sendemail command

Poojitha — Fri, 05 Jan 2024 20:09:34 GMT

@isoutamo This is how my SPL looks like. Alert is created to run on weekly basis

I created subject and email_body using eval and using in sendemail.

Re: Edit CSV file sent through sendemail command

Poojitha — Fri, 05 Jan 2024 20:11:49 GMT

@Anonymous : I am seeing come inconsistency. Once the SPL worked where subject and email body were added as I specified . But sometimes it is not working.
Email is getting sent .

Internal logs show subject and email body as empty 😞

Re: Edit CSV file sent through sendemail command

Esky73 — Tue, 27 Feb 2024 03:52:19 GMT

Came looking for an answer to this as well - seems there has been an idea for this for some time now ..

https://ideas.splunk.com/ideas/EID-I-717