Hi,
I would like to Know if it is possible !
I want to send an email on the adress mail content on my log .
For example:
Index=mail
Result :
log1 : "message information category status Ip data testmail1@mail.com"
log2 : "message information category status Ip data testmail2@mail.com"
log3 : "message information category status Ip data testmail3@mail.com"
Is that possible for the Log1 to send the content of Log1 and send this to the address email on the log ?
For example, to send "message information category status Ip data testmail1@mail.com" to the email on this log : testmail1@mail.com ?
Same for the Log2, it contains information about the testmail2@mail.com and i want to send a mail with the information to testmail2@mail.com ect
Thanks in advance
Steve
You can try this,
| makeresults | eval data="log1:message information category status Ip data testmail1@mail.com,
log2:message information category status Ip data testmail2@mail.com,
log3:message information category status Ip data testmail3@mail.com" | makemv delim="," data | mvexpand data | eval abc=case(like(data, "log1%"), "testmail1@mail.com", like(data, "%log2%"), "testmail2@mail.com", like(data, "%log3%"), "testmail3@mail.com") | eval content=case(like(data, "%log1%"), data, like(data, "%log2%"), data, like(data, "%log3%"), data) |sendemail to=abc message=content