Splunk Dev

sending email with search

yashaswinig2210
Engager

Hi,

I have a query which sends email based on the result and is scheduled for every 5mins.Below is the search

|mysearch | table Owner, AccountName,Machine
| outputcsv Account.csv
| map search="
       |inputcsv Account.csv
       | table Owner, AccountName,Machine|where Owner=\"$Owner$\"
       |sendemail
       sendresults=true inline=true
       from=\"abc@gmail.com\"
       to=\"$Owner$\"     
       subject=\"$AccountName$ \""

this is sending email to the owner every 5mins , my want is the email should be triggered to owner only when it is not triggered in last 24hrs even it is scheduled for 5mins based on the AccountName. 


can we use throttling in this case or Could you please provide me a solution.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, use throttling.

---
If this reply helps you, Karma would be appreciated.
0 Karma

yashaswinig2210
Engager

Could you please tell how can we give throttling and suppression values within the query as the mail is being triggered from the query itself

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Ah, sorry, I thought we were talking about alerts.  There is no throttling within search.  Perhaps you could convert this into an alert?

---
If this reply helps you, Karma would be appreciated.
0 Karma

yashaswinig2210
Engager

In this case my email should be sent to the owner of the account which im getting from the query itself, is there any way to pass field value from the query to send an email from alerts?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...