Splunk Dev

sending email with search

yashaswinig2210
Engager

Hi,

I have a query which sends email based on the result and is scheduled for every 5mins.Below is the search

|mysearch | table Owner, AccountName,Machine
| outputcsv Account.csv
| map search="
       |inputcsv Account.csv
       | table Owner, AccountName,Machine|where Owner=\"$Owner$\"
       |sendemail
       sendresults=true inline=true
       from=\"[email protected]\"
       to=\"$Owner$\"     
       subject=\"$AccountName$ \""

this is sending email to the owner every 5mins , my want is the email should be triggered to owner only when it is not triggered in last 24hrs even it is scheduled for 5mins based on the AccountName. 


can we use throttling in this case or Could you please provide me a solution.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, use throttling.

---
If this reply helps you, Karma would be appreciated.
0 Karma

yashaswinig2210
Engager

Could you please tell how can we give throttling and suppression values within the query as the mail is being triggered from the query itself

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Ah, sorry, I thought we were talking about alerts.  There is no throttling within search.  Perhaps you could convert this into an alert?

---
If this reply helps you, Karma would be appreciated.
0 Karma

yashaswinig2210
Engager

In this case my email should be sent to the owner of the account which im getting from the query itself, is there any way to pass field value from the query to send an email from alerts?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Catalog Is Now Generally Available on Splunk Cloud Platform

A Unified View of Your Data  Security logs, application events, business data, and historical telemetry often ...