Unable to sendmail to multiple recipients

[ibob0304]

Unable to send email to multiple people. How to send to multiple email recipients ?

index="customscripts" sourcetype="email"
|rex field=_raw "Timestamp:\s(?<Timestamp>.+)" 
|rex field=_raw "Application:\s(?<Application>.+)" 
|rex field=_raw "File\sLast\sModified:\s(?<File_Last_Modified>.+)" 
|eval hen ="test1@domain.com,test2@domain.com" |nomv hen 
|table Application, File_Last_Modified
|sendemail to=$hen$ format=table subject="web access log test"  message="Test" sendresults=true inline=true content_type=html

[woodcock]

I tested this and it works:

| makeresults 
| eval hen ="email1, email2" 
| eval increment_me_for_each_test=1
| sendemail to=$result.hen$ format=table subject="web access log test" message="Test" sendresults=true inline=true content_type=html

[somesoni2]

Use like this

...current search before sendemail command
|sendemail to="$result.hen$" ....rest...

[ibob0304]

but that gives additional column hen (with all the recipients) in the output email. I tried yours and got 3 column's output. Application, File_Last_Modified, hen (list of recipients ). I tried fields - hen but it doesn't work.

[ibob0304]

is it possible to remove the list of recipients (hen column) from the output ?

[somesoni2]

I don't think we can with above method. Try this less efficient workaround.

index="customscripts" sourcetype="email"
 |rex field=_raw "Timestamp:\s(?<Timestamp>.+)" 
 |rex field=_raw "Application:\s(?<Application>.+)" 
 |rex field=_raw "File\sLast\sModified:\s(?<File_Last_Modified>.+)" 
 |eval hen ="test1@domain.com,test2@domain.com" |nomv hen 
 |table hen Application, File_Last_Modified
| map maxsearches=100 search="| gentimes start=-1 | eval Application="$Application$" | eval File_Last_Modified="$File_Last_Modified$" |sendemail to=$hen$ format=table subject="web access log test"  message="Test" sendresults=true inline=true content_type=html "

|sendemail to=$hen$ format=table subject="web access log test" message="Test" sendresults=true inline=true content_type=html