Sendemail command email body

[Poojitha]

Hi All,

I am using send email command to send csv file to different recepients based on the search .

| eval subject="This is test subject" ,email_body= "This is test email body"
| map  search="|inputcsv test.csv | where owner=\"$email$\" | sendemail sendcsv=true to=\"$email$\" subject=\"$subject$\" message="\$email_body$\""

I want email body as "This is test email body". Instead I am getting "Search Results attached". I understand message depend on the arguments passed. As I am passing sendcsv=true, I am getting this. I am using sendcsv as I am sending results as attachment(csv file). Please let me know how can I pass custom message to email body.

Regards,
PNV

[inventsekar]

Hi @Poojitha 
I think this looks like a the msg token issue.

Could you pls try this:

|makeresults |eval custommessage="sample sendemail message body" 
|eval dest="[email protected]" 
|sendemail to="$result.dest$" message="$result.custommessage$"

then check if the message body appears as you are expecting. 

more details:

https://docs.splunk.com/Documentation/Splunk/9.1.2/SearchReference/sendemail

https://docs.splunk.com/Documentation/Splunk/9.1.2/Alert/EmailNotificationTokens

upvotes / karma points are appreciated, thanks.