Splunk Search

sendemail for each search result values with 20 line body content

shrinivaskittur
Explorer

Hi,


I have a requirement where my search displays the below result and the out is stored in CSV


Now in another query I am inputting the CSV from the first search and trying to send an email for each filed value of "email_ID" with 20 line email body content, I have tried with the below query (without a email body as I don't know how to insert 20line email body ) but it is giving me an error.
Also, please help me with how to insert 20line email body
Search result :

     email_ID                    Head_ID

-----------------------------------------

abc@abc.com           abc_head@abc.com

shri@abc.com           shri_head@abc.com

xyz@abc.com           xyz_head@abc.com

 

query :

| inputlookup email_ID.csv append=t | fields email_ID Head_ID  | sendemail from="emailaddress@abc.com" to="$email_ID$" cc="$Head_ID $" subject="emailtest" sendresults=true inline=true

query  error: 

  • command="sendemail", {} while sending mail to:
Labels (1)
Tags (1)
0 Karma

burwell
SplunkTrust
SplunkTrust

Hello. If i understand your requirement you want to run one search and send to different email addresses.

There's a handy splunkbase app sendresults: https://splunkbase.splunk.com/app/1794/

You might be interested in using it.

0 Karma

shrinivaskittur
Explorer

Hi,

Thank you for reply...

Yes, I need to run a search then send email to searched values, for example my search result is looks like below and I want to pickup each email_ID mentioned in table and send it separate email for each Email ID.

     email_ID                    Head_ID

-----------------------------------------

abc@abc.com           abc_head@abc.com

shri@abc.com           shri_head@abc.com

xyz@abc.com           xyz_head@abc.com

 

in short considering above is my search result and I want to send 3 separate email to each email_ID ,i.e., abc@abc.com , shri@abc.com and xyz@abc.com 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...