Splunk Search

How do I add a string in the title of a e-mail?

avneet26
Engager

"user-info"
index=user_interface_type sourcetype=* 
| table _time, host, port, _raw | sendemail to="abc@splunk.com" sendresults=true

I use above query to list out the details for the search "user-info"

I want to use this string "user-info" and pass it on in the title of the e-mail as : Notification received for user-info

How to do that ?

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If user-info is a string literal then include it as the value of the subject argument to sendemail.

"user-info" index=user_interface_type sourcetype=* 
| table _time, host, port, _raw 
| sendemail to="abc@splunk.com" sendresults=true subject="user-info"
---
If this reply helps you, Karma would be appreciated.
0 Karma

avneet26
Engager

But i Want to add the subject as "Notification received for <then the string that I searched in the query">

0 Karma

richgalloway
SplunkTrust
SplunkTrust
| sendemail to="abc@splunk.com" sendresults=true subject="Notification received for user-info"

There is no back-reference to string literals.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...