Splunk Search

How to pass the search results to an email body by using sendresults

Path Finder

I am using "sendresults" command and pass the search results to an email body template; however, the search results didn't show up from the body.  Unfortunately, the Splunk sendresults page doesn't have an example for passing the result to the email body.  I wonder if it is possible to pass search results to the email body.  Does anyone know?  

This is the sample code I used.



| makeresults
| eval score=90, email_to="john.doe@xyz.com", name="john"
| append [|makeresults | eval score=76, email_to="jane.doe@abc.com",name="jane"]
| fields - _time
| sendresults showresults=f subject="Your Score" body="Hi $result.name$", your score is $result.score$."




Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...