Splunk Search

Sendemail query: How to send email to individual owners with servers details, who's status is shown as "MISSING"?

raomu
Explorer

Hello,

I have a resultant data like this:

Server Name    Status      Location      Owner   Email Id 

A-Z1           Missing.    Spain.          AAA        AAA@domain.com
A-Z2           Active      Japan           BBB        BBB@domain.com
A-Z3           Missing     Japan           CCC.       CCC@domain.com

I want to send email to individual owners with servers details, who's status is shown "MISSING"

0 Karma

elliotproebstel
Champion

This should get you started:

[ your current search ]
| search Status="Missing"
| map 
 [| sendemail to="$EmailID$" subject="subject line" from=youremail@whatever.com message="Your server status is MISSING"  ]

This is an adaptation from an old post: https://answers.splunk.com/answers/186045/how-can-i-use-a-combination-of-map-and-sendemail-t.html

0 Karma

thambisetty
SplunkTrust
SplunkTrust

I tried its not working

getting below warning

2020-04-26 16:52:22,953 +0400 WARNING sendemail:1505 - search results is empty, no email will be sent

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...