topic Re: How can I use a combination of map and sendemail to include spaces in the field values? in Splunk Search

How can I use a combination of map and sendemail to include spaces in the field values?

stembot — Tue, 11 Nov 2014 05:18:56 GMT

I have a search that uses the values in temp.csv file to generate an email for each row with specific values.

Let's say the csv looks like this
field1, field2
john doe, blah
bob smith, stuff

The search looks like this (quotes within the subsearch are escaped, just not showing here):
| inputlookup temp.csv | map search="| sendemail to=$field2$ subject=\"subject line\" from=def@456.com message=\"test test $field1$ test test \""

My problem is that when the field value (field1 in the search above) contains a space it stops populating the email after the space and sends it as is. It doesn't seem to have an issue with spaces in text specified at search time.

Re: How can I use a combination of map and sendemail to include spaces in the field values?

karabsze — Mon, 27 Apr 2015 09:28:13 GMT

We meet the same issue too. Checked in the search log, it seems that the field with space are failed to be substitute. Anyone has idea about that?

Re: How can I use a combination of map and sendemail to include spaces in the field values?

stembot — Tue, 28 Apr 2015 00:30:07 GMT

Hi karabsze, I had this email from Splunk Support back on March 4th.

Just an update on the issue.
We have fixed the issue of handling variable name with quoted values inside the quotes. This will be included in the next maintance release, 6.1.8, scheduled in the 2nd half of May.
Thank you for your patience on the matter, much appreciated and feel free to ask should you have any more questions on this.
Best regards,

Sung | Splunk Support

I got around the original problem by just using the first name so never tested to see if the issue remained post-6.1.8. Hope that helps.

Re: How can I use a combination of map and sendemail to include spaces in the field values?

masonmorales — Tue, 28 Apr 2015 04:02:18 GMT

As a workaround you could probably do:

| inputlookup temp.csv | replace " " with "_" in field1 | map search="| sendemail to=$field2$ subject="subject line" from=def@456.com message="test test $field1$ test test ""

Re: How can I use a combination of map and sendemail to include spaces in the field values?

ramanjain1983 — Tue, 16 Jun 2015 02:35:45 GMT

Hi guys,

I should have opened a new question but thought this is quite related. Hence adding to the thread.
I am trying to do something similar but the challenge I am seeing that everytime the message is going as literal text string and doesn't look very nicely formatted.

Query is :
index=abc | table line1 line2 EmailID subject
|eval freetext="line1=".line1.";""Line2=".Line2
| map search="
|sendemail server=test.server from=splunk@test.com to=$EmailID$ subject=$subject$" message=$freetext$

This query goes into a loop for all individual rows and send an email to respective/individual EmailIDs having freetext printed as :

Line=sampledata1;Line2=sampledata2

However I am expecting to send the data in this format:

Line=sampledata1
Line2=sampledata2

Any idea? Indeed Line 2 is a URL.

Re: How can I use a combination of map and sendemail to include spaces in the field values?

ramanjain1983 — Tue, 16 Jun 2015 02:43:44 GMT

sorry guys... I found the solution by my own. To my strange the same solution did not work back in older splunk version and worked fine in 6.2.

It is just we need to escape the line out using shift+ enter while creating the message string

Re: How can I use a combination of map and sendemail to include spaces in the field values?

mcronkrite — Tue, 22 Dec 2015 18:15:02 GMT

Other people wondering about this here - xposting for linking https://answers.splunk.com/answers/213340/how-to-get-splunk-sendemail-command-to-send-multip.html

Re: How can I use a combination of map and sendemail to include spaces in the field values?

mcronkrite — Tue, 22 Dec 2015 18:15:41 GMT

this is the right approach - thx

Re: How can I use a combination of map and sendemail to include spaces in the field values?

mcronkrite — Tue, 22 Dec 2015 18:39:53 GMT

Also look at https://answers.splunk.com/answers/27658/map-command-breaks-when-scheduled.html

Re: How can I use a combination of map and sendemail to include spaces in the field values?

thambisetty — Sun, 26 Apr 2020 12:46:37 GMT

this is not working for me.

2020-04-26 16:43:42,996 +0400 WARNING sendemail:1505 - search results is empty, no email will be sent