Splunk Search

SendEmail command to send to different emails

nols76
New Member

Hello all. New to splunk. How can I perform a SendEmail for each log that comes in, which will have a different email address for each?

 index=wm_xsp_cad host=vxxx0u8997 "inactive team" index=wm_xsp_cad host=vxxx30u8997 "Inactive team"|table TeamEmail, ECI, CADesc | eval valueForToHeader=TeamEmail | sendemail 
   sendresults=true inline=true
   to= ????
    Subject=\"$CADesc\$\" 
     From="james@jL.com"

     Subject="hello"
     server= localhost
     graceful=false
Tags (1)
0 Karma

nols76
New Member

Thank you, this is helpful

0 Karma

Yorokobi
SplunkTrust
SplunkTrust

Take a look at the Sendresults search command: https://splunkbase.splunk.com/app/1794/

0 Karma

nols76
New Member

Making some progress with this however I need assistance with sending one email per record, rather than one email for all the records?

index=wm_xsp_cad host=vxxx0u8997 "inactive team" index=wm_xsp_cad host=vxxx30u8997 "Inactive team"|table TeamEmail, ECI, CADesc | eval valueForToHeader=TeamEmail | sendemail 
  sendresults=true inline=true
  to= ????
   Subject=\"$CADesc\$\" 
    From="james@jL.com"

    Subject="hello"
    server= localhost
    graceful=false
0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...