Splunk Search
Highlighted

How to use the sendemail command to send an email to different recipients from a lookup per event?

Communicator

Hi.

I have a lookup object named useremail which contains a notified email list. If there is at least an event found from emaillogs, based on the username within certain time range, we only need to send an email to the associated recipients with simple text such as "xyz found" from the lookup. For instance, this is my format of the lookup:

username          emails
------------      ---------------------------------------------------
xyz               team1@mail.com, team2@mail.com, team3@mail.com
abc               team3@mail.com

How can I use sendemail command in Splunk?

Thanks

0 Karma
Highlighted

Re: How to use the sendemail command to send an email to different recipients from a lookup per event?

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: How to use the sendemail command to send an email to different recipients from a lookup per event?

Esteemed Legend

This is from another Q&A:
https://answers.splunk.com/answers/399434/send-emailed-results-to-an-email-address-in-the-re.html#an...

If you need to send a contextually-appropriate subset of results to some people, you can skip the configuration-based email settings and do this in SPL:

... | outputcsv TempFile.csv
| stats values(Email_Address) AS emailToHeader | mvexpand emailToHeader
| map search ="|inputcsv TempFile.csv | where Email_Addresss=\"$emailToHeader$\"
   | fields - Email_Address
   | sendemail
      sendresults=true inline=true
      server=\"Your.Value.Here\"
      from=\"Your.Value.Here\"
      to=\"$emailToHeader$\"
      subject=\"Your Subject here: \$name\$\"
      message=\"This report alert was generated by \$app\$ Splunk with this search string: \$search\$\""
| where comment="MakeSureNoEventsRemail"
| append [|inputcsv TempFile.csv]
0 Karma
Highlighted

Re: How to use the sendemail command to send an email to different recipients from a lookup per event?

Communicator

Thanks woodcock.

I got two different issues although it seems working. Do you have any clues?
1) If there aren't any findings, getting the following error:
"Error in "map": Did not find value for required attributes 'xyz'

2) If there are some findings, the emails are sent out properly; however, there is an error message showed as "[subsearch]: command="sendemail", {} while sending mail to"

Thanks.

0 Karma
Highlighted

Re: How to use the sendemail command to send an email to different recipients from a lookup per event?

Esteemed Legend

Number 1 is "normal" and I have not found a good way to code around it. Number 2 I have never seen before and cannot reproduce.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.