Reporting

WHY is sendemail to=$mail$ not working ?

lifekis
Explorer

hello, 

sendemail can not work variable fields.

example,

 

 

index=mail
| table id domain
| eval email=id."@abc.com"
| sendemail to="$email$" subject="test" sendresult=true inline=true message="test"

 

 

>> command="sendemail", {} while sending mail to:

 

 

 

index=_internal email

 

 

>> ERROR sending email. subject="test", results_line="None", recipients="[]", server="localhost"

 

why can't I identify my email address?

it works normally when i enter email address.

 

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The way you are using it, $email$ is notation for a token, not a field - have you tried

| sendemail to=email subject="test" sendresult=true inline=true message="test"
0 Karma

lifekis
Explorer

The following information is output:
before: 
ERROR sending email. subject="test", results_line="None", recipients="[]", server="localhost"
after: INFO sending email. subject="test", results_line="None", recipients="[email]", server="localhost"

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...