Can you help me figure out this error I'm getting with a search using the sendemail command?

[vumanhtai]

Hi Splunk Team!

I have a query as shown below:

my search | outputlookup emailspam.csv | sendemail  from= server=  subject=Alert message="text"  to=[|inputlookup emailspam.csv]

In general, my search prints all the result emails to file "emailspam.csv", and later on, I use this file as the receiving addresses. However, after running this query, I got an error :

command="sendemail", {} while sending mail to

I know the issue comes from " to=[|inputlookup emailspam.csv]"

I want to send all emails in file emailspam.csv

[DMohn · Accepted solution]

Assuming your CSV contains a list of email adresses, you have to convert this to a comma-separated string of recipients.

Try the following:

my search | outputlookup emailspam.csv | sendemail from= server= subject=Alert message="text" [|inputlookup emailspam.csv | mvcombine email| eval to=mvjoin(email,", ") | return to]

This assumes you have one field in your CVS named email. Change the command if needed.

[vumanhtai]

thank DMohn!

[DMohn]

Can you post an example of your |inputlookup output, e.g. how the CSV file looks like?

[vumanhtai]

Hi DMohn!
file emailspam.csv:
from
email1
email2
email3
email4

[DMohn]

In that case you can use the query I stated in the answer below, just replace the email field with from