Dear Splunk bro team,
We are in trouble while send result of scheduled search to email.
Our Scheduled search result have a field that indicate who get result.
for example :
field_A code email
a 1 [email protected]
b 2 [email protected]
c 1 [email protected]
d 2 [email protected]
Currently, savedsearch are sending earch record is one email (total 4 emails to 2 receipent ).
Expected (2 emails):
+ mail1 send content to [email protected] in 1 file csv
field_A code email
a 1 [email protected]
c 1 [email protected]
+ mail2 send content [email protected] in 1 file csv
field_A code email
b 2 [email protected]
d 2 [email protected]
