How to extract the email_id from my sample event, then use the sendemail command to send the event to the extracted email?

[rajeshbikram]

Hi,

I have events as below,

2016-06-29 16:05:13,994 ERROR host=localhost service=check_process state=alert description=Response code from jolokia is not 200. metric=500.0  time=1.467241513994E9 email_id=a@b.com,c@d.com role=node actor_name=test environment=dev

What is the best way to extract email_id and use sendemail to send email with event.

[sundareshr]

@MuS has the best answer, I have seen to a similar/related question

https://answers.splunk.com/answers/213340/how-to-get-splunk-sendemail-command-to-send-multip.html