Hi Splunk Team!
I have a query as shown below:
my search | outputlookup emailspam.csv | sendemail from= server= subject=Alert message="text" to=[|inputlookup emailspam.csv]
In general, my search prints all the result emails to file "emailspam.csv", and later on, I use this file as the receiving addresses. However, after running this query, I got an error :
command="sendemail", {} while sending mail to
I know the issue comes from " to=[|inputlookup emailspam.csv]"
I want to send all emails in file emailspam.csv
Assuming your CSV contains a list of email adresses, you have to convert this to a comma-separated string of recipients.
Try the following:
my search | outputlookup emailspam.csv | sendemail from= server= subject=Alert message="text" [|inputlookup emailspam.csv | mvcombine email| eval to=mvjoin(email,", ") | return to]
This assumes you have one field in your CVS named email. Change the command if needed.
Assuming your CSV contains a list of email adresses, you have to convert this to a comma-separated string of recipients.
Try the following:
my search | outputlookup emailspam.csv | sendemail from= server= subject=Alert message="text" [|inputlookup emailspam.csv | mvcombine email| eval to=mvjoin(email,", ") | return to]
This assumes you have one field in your CVS named email. Change the command if needed.
thank DMohn!
Can you post an example of your |inputlookup
output, e.g. how the CSV file looks like?
Hi DMohn!
file emailspam.csv:
from
email1
email2
email3
email4
In that case you can use the query I stated in the answer below, just replace the email
field with from