Splunk Search

How do I add a string in the title of a e-mail?

avneet26
Engager

"user-info"
index=user_interface_type sourcetype=* 
| table _time, host, port, _raw | sendemail to="abc@splunk.com" sendresults=true

I use above query to list out the details for the search "user-info"

I want to use this string "user-info" and pass it on in the title of the e-mail as : Notification received for user-info

How to do that ?

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If user-info is a string literal then include it as the value of the subject argument to sendemail.

"user-info" index=user_interface_type sourcetype=* 
| table _time, host, port, _raw 
| sendemail to="abc@splunk.com" sendresults=true subject="user-info"
---
If this reply helps you, Karma would be appreciated.
0 Karma

avneet26
Engager

But i Want to add the subject as "Notification received for <then the string that I searched in the query">

0 Karma

richgalloway
SplunkTrust
SplunkTrust
| sendemail to="abc@splunk.com" sendresults=true subject="Notification received for user-info"

There is no back-reference to string literals.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...