Splunk Search

How to use the sendemail command to send an email to different recipients from a lookup per event?

splunkrocks2014
Communicator

Hi.

I have a lookup object named user_email which contains a notified email list. If there is at least an event found from email_logs, based on the username within certain time range, we only need to send an email to the associated recipients with simple text such as "xyz found" from the lookup. For instance, this is my format of the lookup:

username          emails
------------      ---------------------------------------------------
xyz               team1@mail.com, team2@mail.com, team3@mail.com
abc               team3@mail.com

How can I use sendemail command in Splunk?

Thanks

0 Karma

sirajnp
Path Finder

It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result.

https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_r...

0 Karma

woodcock
Esteemed Legend

This is from another Q&A:
https://answers.splunk.com/answers/399434/send-emailed-results-to-an-email-address-in-the-re.html#an...

If you need to send a contextually-appropriate subset of results to some people, you can skip the configuration-based email settings and do this in SPL:

... | outputcsv TempFile.csv
| stats values(Email_Address) AS emailToHeader | mvexpand emailToHeader
| map search ="|inputcsv TempFile.csv | where Email_Addresss=\"$emailToHeader$\"
   | fields - Email_Address
   | sendemail
      sendresults=true inline=true
      server=\"Your.Value.Here\"
      from=\"Your.Value.Here\"
      to=\"$emailToHeader$\"
      subject=\"Your Subject here: \$name\$\"
      message=\"This report alert was generated by \$app\$ Splunk with this search string: \$search\$\""
| where comment="MakeSureNoEventsRemail"
| append [|inputcsv TempFile.csv]
0 Karma

splunkrocks2014
Communicator

Thanks woodcock.

I got two different issues although it seems working. Do you have any clues?
1) If there aren't any findings, getting the following error:
"Error in "map": Did not find value for required attributes 'xyz'

2) If there are some findings, the emails are sent out properly; however, there is an error message showed as "[subsearch]: command="sendemail", {} while sending mail to"

Thanks.

0 Karma

woodcock
Esteemed Legend

Number 1 is "normal" and I have not found a good way to code around it. Number 2 I have never seen before and cannot reproduce.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...