Why are users getting "No results found" in the email they receive from running a map search with the sendemail command?

[kalianov]

Hi all,

my search | stats count(filename) AS files, sum(size) AS TotalMb by user| sort -TotalMb | eval email=user."@mydomai.com" 
| table user, files, TotalMb, email | head 2 

Result is:

user1,   123,    506, user1@mydomai.com
user2,   234,    26,   user2@mydomai.com

I need to send each row for each of user from search result:

 fitst string to user1@mydomai.com
 second string to user2@mydomai.com

I am using:

my search | stats count(filename) AS files, sum(size) AS TotalMb by user| sort -TotalMb | eval email=user."@mydomai.com" 
| table user, files, TotalMb, email | head 2 
| map search="sendemail to=$email$ from=splunk@mydomain.com subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST""

Result is emailed for each user with "No results found". Why are users not receiving emails with the results of the search?

Please help

[martin_mueller]

Skip the entire map approach. Ground rule: map is never the answer, there are very very few exceptions.

Instead, configure your alert to send to $result.email$ and to act per event instead of per result. Then you will automagically get two emails.
Requires 6.1 or something similarly old, by now.

[somesoni2 · Accepted solution]

The map command is used to executed a search (map subsearch) for each result of the base search. Here for each row of base search (those two rows with user1 and user2), the map subsearch (string witing quotes) is "sendemail to=$email$ from=splunk@mydomain.com subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST", which is not a valid full search and thus the no result found.

Try something like this

my search | stats count(filename) AS files, sum(size) AS TotalMb by user| sort -TotalMb | eval email=user."@mydomai.com" 
 | table user, files, TotalMb, email | map search="|gentimes start=-1 | eval user="$user$" | eval files=$files$ | eval TotalMb=$TotalMb$ |  sendemail to=$email$ from=splunk@mydomain.com subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST""