Splunk Search

Splunk - Sendemail for each output row

vamsigurram
Path Finder

Hi,

I have a tabular results of folks, who are using index=* in their searches.

So i have SPL that outputs below

UserapptitleSPLemail
user1searchxyzindex=*abc\@test.com
user2app1abcindex=* source=*user2\@test.com

 

WHen i add the below command, i see email of all the results in the table.

| sendemail to="abc@test.com" format=table subject=myresults sendresults=true inline=true

 

But i want user1, to get only his/her result

Similarly user2, should get only his/her result.

 

SO i tried below. but none worked.

| map [|sendemail to="$email$" format=table subject=myresults sendresults=true inline=true]

| map [sendemail to="$email$" format=table subject=myresults sendresults=true inline=true]

 

| map  search="|sendemail to="$email$" format=table subject=myresults sendresults=true inline=true"

| map  search="sendemail to="$email$" format=table subject=myresults sendresults=true inline=true"

 

Please let me know the right syntax.

Labels (1)
0 Karma
1 Solution

tscroggins
Builder

@vamsigurram 

The map command has access to field values through replacement tokens. Try something like this:

| map search="| makeresults | sendemail to=\"$email$\" subject=\"myresults\" message=\"User,app,title,SPL,email\n\\\"$User$\\\",\\\"$app$\\\",\\\"$title$\\\",\\\"$SPL$\\\",\\\"$email$\\\"\""

If this is an alert search, you can configure the alert itself to trigger one email action per result and use $result.email$ in the To action argument.

View solution in original post

0 Karma

vamsigurram
Path Finder

Thanks @tscroggins

This is exactly, what i wanted.

Both your suggestions worked.

0 Karma

tscroggins
Builder

@vamsigurram 

The map command has access to field values through replacement tokens. Try something like this:

| map search="| makeresults | sendemail to=\"$email$\" subject=\"myresults\" message=\"User,app,title,SPL,email\n\\\"$User$\\\",\\\"$app$\\\",\\\"$title$\\\",\\\"$SPL$\\\",\\\"$email$\\\"\""

If this is an alert search, you can configure the alert itself to trigger one email action per result and use $result.email$ in the To action argument.

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.