So I'm trying to pipe a search query to sendemail to email specific messages based on search results and format the message/body of that email to use line breaks and paragraphs rather than one long message. (Splunk 6.1.4)
search query | sendemail to=email_address from=from_email subject=alert_subject message="Alert first line \r\n second line with $result.Field$ \r\n third line"
No luck. And I know it's not outlook messing up the message because the default footer is correctly displayed with proper line breaks. The default footer should be: "If you believe you've received this email in error, please see your Splunk administrator.\r\n\r\nsplunk > the engine for machine data." according to the documentation but \r\n doesn't seem to work for me.
I can format the message correctly using the built in alert tool but I can't customize the FROM address using the alert app, so trying to get sendemail to work.
you might want to try Shift + Enter to get a newline within the search query.
Moreover: If you would like to have your result embedded in a certain text, you should form your search in a way everything fits in one event and one field (😞 ... | eval raw="This is my first value: " + file + ", and<<Shift+Enter*>> my second value: " + 'file' + "." | table raw | rename raw as _raw | sendemail format=raw sendresults=true ... message="welcome message"
To archive this (*), you may have to use commands like transpose, foreach, xyseries, untable