So here is the answer that I got while working with support; Use this search: Your_search Foo=* | stats count by "foo" | sort "foo"| sendemail [email protected] server=mail_relay.yourdomain.com subject="Here is an email from Splunk SearchHead" message="This is an example message" sendresults=true inline=true format=raw sendpdf=true Change sendprf to sendcsv or change true to false to see what is working and what is not. In my case everything but CSV attachment was working. this lead support to look at the sendmail.py and why all other functions were working and not send mail. I had added a datestamp variable to be added to the csv file name like this: # create datestamp for filename datestamp = time.strftime('%Y-%m-%d') I don't remember where I got this Mod but it came with this line also # strip control characters, forward & backslash filename = re.sub(r'[\x00-\x1f\x7f/\\]+', '-', filename) The I changed this line in the sendmail.py file in $splunkhome/etc/apps/search/bin/ from: csvAttachment.add_header('Content-Disposition', 'attachment', filename="splunk-results.csv") to: csvAttachment.add_header('Content-Disposition', 'attachment', filename = '%s-%s.csv' % (subject, datestamp)) Support was able to see that the filename= was referenced in the "# strip control caterers" before it was referenced in the "csvAttachment.add_header" I commented out the line filename = re.sub(r'[\x00-\x1f\x7f/\\]+', '-', filename) and attachments started working again. At some time in the future I will test taking out control characters but for now it is working. use the email test above to test email functions when editing custom sendmail.py configurations ... View more