Splunk Search

Why are users getting "No results found" in the email they receive from running a map search with the sendemail command?

kalianov
Path Finder

Hi all,

my search | stats count(filename) AS files, sum(size) AS TotalMb by user| sort -TotalMb | eval email=user."@mydomai.com" 
| table user, files, TotalMb, email | head 2 

Result is:

user1,   123,    506, user1@mydomai.com
user2,   234,    26,   user2@mydomai.com

I need to send each row for each of user from search result:

 fitst string to user1@mydomai.com
 second string to user2@mydomai.com

I am using:

my search | stats count(filename) AS files, sum(size) AS TotalMb by user| sort -TotalMb | eval email=user."@mydomai.com" 
| table user, files, TotalMb, email | head 2 
| map search="sendemail to=$email$ from=splunk@mydomain.com subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST""

Result is emailed for each user with "No results found". Why are users not receiving emails with the results of the search?

Please help

0 Karma
1 Solution

somesoni2
Revered Legend

The map command is used to executed a search (map subsearch) for each result of the base search. Here for each row of base search (those two rows with user1 and user2), the map subsearch (string witing quotes) is "sendemail to=$email$ from=splunk@mydomain.com subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST", which is not a valid full search and thus the no result found.

Try something like this

my search | stats count(filename) AS files, sum(size) AS TotalMb by user| sort -TotalMb | eval email=user."@mydomai.com" 
 | table user, files, TotalMb, email | map search="|gentimes start=-1 | eval user="$user$" | eval files=$files$ | eval TotalMb=$TotalMb$ |  sendemail to=$email$ from=splunk@mydomain.com subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST""

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Skip the entire map approach. Ground rule: map is never the answer, there are very very few exceptions.

Instead, configure your alert to send to $result.email$ and to act per event instead of per result. Then you will automagically get two emails.
Requires 6.1 or something similarly old, by now.

somesoni2
Revered Legend

The map command is used to executed a search (map subsearch) for each result of the base search. Here for each row of base search (those two rows with user1 and user2), the map subsearch (string witing quotes) is "sendemail to=$email$ from=splunk@mydomain.com subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST", which is not a valid full search and thus the no result found.

Try something like this

my search | stats count(filename) AS files, sum(size) AS TotalMb by user| sort -TotalMb | eval email=user."@mydomai.com" 
 | table user, files, TotalMb, email | map search="|gentimes start=-1 | eval user="$user$" | eval files=$files$ | eval TotalMb=$TotalMb$ |  sendemail to=$email$ from=splunk@mydomain.com subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST""
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...