Unable to send email to multiple people. How to send to multiple email recipients ?
index="customscripts" sourcetype="email"
|rex field=_raw "Timestamp:\s(?<Timestamp>.+)"
|rex field=_raw "Application:\s(?<Application>.+)"
|rex field=_raw "File\sLast\sModified:\s(?<File_Last_Modified>.+)"
|eval hen ="test1@domain.com,test2@domain.com" |nomv hen
|table Application, File_Last_Modified
|sendemail to=$hen$ format=table subject="web access log test" message="Test" sendresults=true inline=true content_type=html
I tested this and it works:
| makeresults
| eval hen ="email1, email2"
| eval increment_me_for_each_test=1
| sendemail to=$result.hen$ format=table subject="web access log test" message="Test" sendresults=true inline=true content_type=html
Use like this
...current search before sendemail command
|sendemail to="$result.hen$" ....rest...
but that gives additional column hen (with all the recipients) in the output email. I tried yours and got 3 column's output. Application, File_Last_Modified, hen (list of recipients ). I tried fields - hen but it doesn't work.
is it possible to remove the list of recipients (hen column) from the output ?
I don't think we can with above method. Try this less efficient workaround.
index="customscripts" sourcetype="email"
|rex field=_raw "Timestamp:\s(?<Timestamp>.+)"
|rex field=_raw "Application:\s(?<Application>.+)"
|rex field=_raw "File\sLast\sModified:\s(?<File_Last_Modified>.+)"
|eval hen ="test1@domain.com,test2@domain.com" |nomv hen
|table hen Application, File_Last_Modified
| map maxsearches=100 search="| gentimes start=-1 | eval Application="$Application$" | eval File_Last_Modified="$File_Last_Modified$" |sendemail to=$hen$ format=table subject="web access log test" message="Test" sendresults=true inline=true content_type=html "
|sendemail to=$hen$ format=table subject="web access log test" message="Test" sendresults=true inline=true content_type=html