sendmail to multiple users based on table output

[harryvdtol]

Hello,


I want to send multiple mails, based on the data in the seearch results.
I have tried many posts, but i am still unable to get this working.

For each email address i want to send an email.
In my example i want to send 2 emails.

This is my query example

| makeresults
| eval kol1="line-1",kol2="line-1", email="[email protected]"
| append [ | makeresults | eval kol1="line-2",kol2="line-2", email="[email protected]" ]
| append [ | makeresults | eval kol1="line-3",kol2="line-3", email="[email protected]" ]
| append [ | makeresults | eval kol1="line-1",kol2="line-1", email="[email protected]" ]
| append [ | makeresults | eval kol1="line-2",kol2="line-2", email="[email protected]" ]
| table kol1 kol2 email
| map search="|makeresults |sendemail to="$email$" from="[email protected]" incline=true sendresults=true subject="test" message=$kol1$ $kol2$"

The result is, that i a getting 5 emails, with a content of only kol1 as message

I am thinking of alternatives, but that looks to complicated for now , like this...
https://community.splunk.com/t5/Splunk-Cloud-Platform/Send-email-to-multiple-users-with-respective-d...

Is it somehow possible to do get this working?

Regards,

Harry

[harryvdtol]

And it works

[harryvdtol · Accepted solution]

I am going to do it in two steps
Make an outputlookup for the data.
And with another search inputlookup and this commanmd

| inputlookup mytempdata.csv
| stats values(email) as email
| mvexpand email
| map search="
    | inputlookup mytempdata.csv
    | where match(email, \"^$email$\")
    | sendemail
        to=\"$email$\"
        subject=\"My Subject\"
        message=\"My Message\"
        sendresults=true
        inline=true 
        format=table 
        sendpdf=false 
        sendcsv=false
    " maxsearches=100