Splunk Search

SendEmail command to send to different emails

nols76
New Member

Hello all. New to splunk. How can I perform a SendEmail for each log that comes in, which will have a different email address for each?

 index=wm_xsp_cad host=vxxx0u8997 "inactive team" index=wm_xsp_cad host=vxxx30u8997 "Inactive team"|table TeamEmail, ECI, CADesc | eval valueForToHeader=TeamEmail | sendemail 
   sendresults=true inline=true
   to= ????
    Subject=\"$CADesc\$\" 
     From="james@jL.com"

     Subject="hello"
     server= localhost
     graceful=false
Tags (1)
0 Karma

nols76
New Member

Thank you, this is helpful

0 Karma

Yorokobi
SplunkTrust
SplunkTrust

Take a look at the Sendresults search command: https://splunkbase.splunk.com/app/1794/

0 Karma

nols76
New Member

Making some progress with this however I need assistance with sending one email per record, rather than one email for all the records?

index=wm_xsp_cad host=vxxx0u8997 "inactive team" index=wm_xsp_cad host=vxxx30u8997 "Inactive team"|table TeamEmail, ECI, CADesc | eval valueForToHeader=TeamEmail | sendemail 
  sendresults=true inline=true
  to= ????
   Subject=\"$CADesc\$\" 
    From="james@jL.com"

    Subject="hello"
    server= localhost
    graceful=false
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...