Splunk Search

How to pass the search results to an email body by using sendresults

lucas4394
Path Finder

I am using "sendresults" command and pass the search results to an email body template; however, the search results didn't show up from the body.  Unfortunately, the Splunk sendresults page doesn't have an example for passing the result to the email body.  I wonder if it is possible to pass search results to the email body.  Does anyone know?  

This is the sample code I used.

 

 

| makeresults
| eval score=90, email_to="john.doe@xyz.com", name="john"
| append [|makeresults | eval score=76, email_to="jane.doe@abc.com",name="jane"]
| fields - _time
| sendresults showresults=f subject="Your Score" body="Hi $result.name$", your score is $result.score$."

 

 

 

Labels (1)
Tags (1)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>