Splunk Search

Splunk - Sendemail for each output row

vamsigurram
Path Finder

Hi,

I have a tabular results of folks, who are using index=* in their searches.

So i have SPL that outputs below

UserapptitleSPLemail
user1searchxyzindex=*abc\@test.com
user2app1abcindex=* source=*user2\@test.com

 

WHen i add the below command, i see email of all the results in the table.

| sendemail to="abc@test.com" format=table subject=myresults sendresults=true inline=true

 

But i want user1, to get only his/her result

Similarly user2, should get only his/her result.

 

SO i tried below. but none worked.

| map [|sendemail to="$email$" format=table subject=myresults sendresults=true inline=true]

| map [sendemail to="$email$" format=table subject=myresults sendresults=true inline=true]

 

| map  search="|sendemail to="$email$" format=table subject=myresults sendresults=true inline=true"

| map  search="sendemail to="$email$" format=table subject=myresults sendresults=true inline=true"

 

Please let me know the right syntax.

Labels (1)
0 Karma
1 Solution

tscroggins
Influencer

@vamsigurram 

The map command has access to field values through replacement tokens. Try something like this:

| map search="| makeresults | sendemail to=\"$email$\" subject=\"myresults\" message=\"User,app,title,SPL,email\n\\\"$User$\\\",\\\"$app$\\\",\\\"$title$\\\",\\\"$SPL$\\\",\\\"$email$\\\"\""

If this is an alert search, you can configure the alert itself to trigger one email action per result and use $result.email$ in the To action argument.

View solution in original post

0 Karma

vamsigurram
Path Finder

Thanks @tscroggins

This is exactly, what i wanted.

Both your suggestions worked.

0 Karma

tscroggins
Influencer

@vamsigurram 

The map command has access to field values through replacement tokens. Try something like this:

| map search="| makeresults | sendemail to=\"$email$\" subject=\"myresults\" message=\"User,app,title,SPL,email\n\\\"$User$\\\",\\\"$app$\\\",\\\"$title$\\\",\\\"$SPL$\\\",\\\"$email$\\\"\""

If this is an alert search, you can configure the alert itself to trigger one email action per result and use $result.email$ in the To action argument.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...