sendMail "From= "

[alvesri]

Hi guys, 

Thank you in advance, 

Is it possible to use a value of the search result as a parameter in the |sendmail from=" ? "

In the | sendmail to="we can use results.mail_to" but in case of | sendmail from="results.mail_from" don't work.

We already disable the security options for this.

 
like for example 

i

ndex="main"

| eval mail_from = "username@mail.com"
| eval mail_to = "username@mail.com"
| eval subject = "subject"

| table username age country city

| sendemail to=$result.mail_to$ from= $result_mail_from$ subject=$results.subject$ message="This is an example message" sendresults=true inline=true format=table sendcsv=true

[kartm2020]

Hi,

Can you please use the mail server parameter with the email ID as mentioned in the below docs.

server="server info"

https://docs.splunk.com/Documentation/Splunk/8.1.0/Alert/Emailnotification

[isoutamo]

Hi

you must use valid email address on from field. Currently most email servers require that those senders must be within valid and permitted domains. Depending on your configuration it could be that you can use only that from field and user which are configured into your splunk and given by email provider.

r. Ismo