Splunk Search

Unable to sendmail to multiple recipients

Communicator

Unable to send email to multiple people. How to send to multiple email recipients ?

index="customscripts" sourcetype="email"
|rex field=_raw "Timestamp:\s(?<Timestamp>.+)" 
|rex field=_raw "Application:\s(?<Application>.+)" 
|rex field=_raw "File\sLast\sModified:\s(?<File_Last_Modified>.+)" 
|eval hen ="test1@domain.com,test2@domain.com" |nomv hen 
|table Application, File_Last_Modified
|sendemail to=$hen$ format=table subject="web access log test"  message="Test" sendresults=true inline=true content_type=html
0 Karma

Esteemed Legend

I tested this and it works:

| makeresults 
| eval hen ="email1, email2" 
| eval increment_me_for_each_test=1
| sendemail to=$result.hen$ format=table subject="web access log test" message="Test" sendresults=true inline=true content_type=html
0 Karma

Revered Legend

Use like this

...current search before sendemail command
|sendemail to="$result.hen$" ....rest...
0 Karma

Communicator

but that gives additional column hen (with all the recipients) in the output email. I tried yours and got 3 column's output. Application, File_Last_Modified, hen (list of recipients ). I tried fields - hen but it doesn't work.

0 Karma

Communicator

is it possible to remove the list of recipients (hen column) from the output ?

0 Karma

Revered Legend

I don't think we can with above method. Try this less efficient workaround.

index="customscripts" sourcetype="email"
 |rex field=_raw "Timestamp:\s(?<Timestamp>.+)" 
 |rex field=_raw "Application:\s(?<Application>.+)" 
 |rex field=_raw "File\sLast\sModified:\s(?<File_Last_Modified>.+)" 
 |eval hen ="test1@domain.com,test2@domain.com" |nomv hen 
 |table hen Application, File_Last_Modified
| map maxsearches=100 search="| gentimes start=-1 | eval Application="$Application$" | eval File_Last_Modified="$File_Last_Modified$" |sendemail to=$hen$ format=table subject="web access log test"  message="Test" sendresults=true inline=true content_type=html "

|sendemail to=$hen$ format=table subject="web access log test" message="Test" sendresults=true inline=true content_type=html

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!