Splunk - Sendemail for each output row

[vamsigurram]

Hi,

I have a tabular results of folks, who are using index=* in their searches.

So i have SPL that outputs below

User	app	title	SPL	email
user1	search	xyz	index=*	abc\@test.com
user2	app1	abc	index=* source=*	user2\@test.com

WHen i add the below command, i see email of all the results in the table.

| sendemail to="[email protected]" format=table subject=myresults sendresults=true inline=true

But i want user1, to get only his/her result

Similarly user2, should get only his/her result.

SO i tried below. but none worked.

| map [|sendemail to="$email$" format=table subject=myresults sendresults=true inline=true]

| map [sendemail to="$email$" format=table subject=myresults sendresults=true inline=true]

| map  search="|sendemail to="$email$" format=table subject=myresults sendresults=true inline=true"

| map  search="sendemail to="$email$" format=table subject=myresults sendresults=true inline=true"

Please let me know the right syntax.

[vamsigurram]

Thanks @tscroggins

This is exactly, what i wanted.

Both your suggestions worked.

[tscroggins · Accepted solution]

@vamsigurram 

The map command has access to field values through replacement tokens. Try something like this:

| map search="| makeresults | sendemail to=\"$email$\" subject=\"myresults\" message=\"User,app,title,SPL,email\n\\\"$User$\\\",\\\"$app$\\\",\\\"$title$\\\",\\\"$SPL$\\\",\\\"$email$\\\"\""

If this is an alert search, you can configure the alert itself to trigger one email action per result and use $result.email$ in the To action argument.