Splunk Search
Highlighted

sendemail to a field value - without script?

Communicator

Hi, I am trying to send search results to an email address using the sendemail command.

If I "hardcode" the to field in my sendemail command, this works great. However the goal is to send the email to a field value from the search itself..so..

source=reallyBadUsers | Table User, Manager, ManagerEmailAddr | sendemail to=$ManagerEmailAddr$ sendresults=true priority=high subject="This guy is really bad" server=x.x.x.x

Obviously I've learned that $ManagerEmailAddr$ is not going to work.

How can I work around this? The "to" address will be dependent on the ManagerEmailAddr from the search.

Thanks,

Brian

0 Karma
Highlighted

Re: sendemail to a field value - without script?

SplunkTrust
SplunkTrust

Try this

source=reallyBadUsers | Table User, Manager, ManagerEmailAddr | sendemail [source=reallyBadUsers | Table ManagerEmailAddr | mvcombine delim="," ManagerEmailAddr | nomv ManagerEmailAddr  | rename ManagerEmailAddr as to]  sendresults=true priority=high subject="This guy is really bad"
Highlighted

Re: sendemail to a field value - without script?

Path Finder

Hi somesoni2,

From your above example, I got following query which is supposed send an email of the result, if result > 0 to predefined user email. The srcemail needs to be dynamically set. But it is sending the email even though there is no result. Please advise how to update it to only sendemail when result > 0. Thanks


earliest=-60m@m index=network comment="Comment"
| dedup local
starttime srcname srcnumber srcemail srcsite srclocation destname dstnumber
| table localstarttime srcname srcnumber srcemail srcsite srclocation destname dstnumber
| eval from=src
email | sendemail
[ search earliest=-60m@m index=network comment="Comment"
| dedup localstarttime srcname srcnumber srcemail srcsite srclocation destname dstnumber
| table src
email
| rename src_email as from] to="mike@company.org" format=table subject="Comment" server=mail.company.org sendresults=true inline=true

0 Karma
Highlighted

Re: sendemail to a field value - without script?

Explorer

Hi,
I had same issue. The above query did not send email also. Please let me know if you are able to get the solution.

Regards,
Pallavi

0 Karma
Highlighted

Re: sendemail to a field value - without script?

Path Finder

Hi,
you should go for the "sendresults Command": https://splunkbase.splunk.com/app/1794 (details here: app details)

This app basically configures a custom command that allows you to:

Dynamically evaluate who to send
results to, based upon the results of
the search itself

I used it in the past and it works charmingly..

Hope this helps,
regards

0 Karma