Splunk Enterprise

How to create a search based on search results using command 'sendemail'?

gl_splunkuser
Path Finder

Hello, I am using Splunk enterprise 7.3.5.

I would like to send an email, using the command sendemail, but I would like to create it based on a search result, so I am trying:

 

eventtype = myeventype | table message_subject, sender_address |sendemail sendresults=true inline=true from=$sender_address$ subject=$message_subject$ to=myemail

 

Where

message_subject and sender_address, are fields of the search. 

But when I received the email, looks like- (see the attached image)

Basically, the parameters are not working, I received the email without any of those parameters set.

 

email_bySplunk.PNG

How can I fix that?

Tags (2)
0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust
0 Karma

gl_splunkuser
Path Finder

Sendresults as I read don't have the feature to set parameters in the value - sender: The sender (from) address of the emails - requires quotes. Defaults to Splunk SMTP sender setting. The same sender is used for all emails sent and not customizable on a per-email basis. - 

And I need to set that value as a parameter.

 

Thanks for your help. 

Tags (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust

Quoting the details page of sendresults app from SplunkBase:

"The Search Command version of Sendresults supports the following syntax and optional arguments:

sendresults [sender=string] [subject=string] [body=string] [footer=string] [maxrcpts=int] [msgstyle=string] [format_columns=string] [bcc=string] [showresults=boolean] [showemail=boolean] [showsubj=boolean] [showbody=boolean] [showfooter=boolean]

sender: The sender (from) address of the emails - requires quotes. Defaults to Splunk SMTP sender setting. The same sender is used for all emails sent and not customizable on a per-email basis."

gl_splunkuser
Path Finder

I used the app sendresults, works pretty well, but I modify the sendresults.py to have the capability to use the sender as a parameter.

Code:

sender = event['sender']

And sent it as a parameter of sendemail function. 

Thanks for the suggestion @gjanders 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...