Splunk Enterprise

How to create a search based on search results using command 'sendemail'?

gl_splunkuser
Path Finder

Hello, I am using Splunk enterprise 7.3.5.

I would like to send an email, using the command sendemail, but I would like to create it based on a search result, so I am trying:

 

eventtype = myeventype | table message_subject, sender_address |sendemail sendresults=true inline=true from=$sender_address$ subject=$message_subject$ to=myemail

 

Where

message_subject and sender_address, are fields of the search. 

But when I received the email, looks like- (see the attached image)

Basically, the parameters are not working, I received the email without any of those parameters set.

 

email_bySplunk.PNG

How can I fix that?

Tags (2)
0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust
0 Karma

gl_splunkuser
Path Finder

Sendresults as I read don't have the feature to set parameters in the value - sender: The sender (from) address of the emails - requires quotes. Defaults to Splunk SMTP sender setting. The same sender is used for all emails sent and not customizable on a per-email basis. - 

And I need to set that value as a parameter.

 

Thanks for your help. 

Tags (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust

Quoting the details page of sendresults app from SplunkBase:

"The Search Command version of Sendresults supports the following syntax and optional arguments:

sendresults [sender=string] [subject=string] [body=string] [footer=string] [maxrcpts=int] [msgstyle=string] [format_columns=string] [bcc=string] [showresults=boolean] [showemail=boolean] [showsubj=boolean] [showbody=boolean] [showfooter=boolean]

sender: The sender (from) address of the emails - requires quotes. Defaults to Splunk SMTP sender setting. The same sender is used for all emails sent and not customizable on a per-email basis."

gl_splunkuser
Path Finder

I used the app sendresults, works pretty well, but I modify the sendresults.py to have the capability to use the sender as a parameter.

Code:

sender = event['sender']

And sent it as a parameter of sendemail function. 

Thanks for the suggestion @gjanders 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...