Thanks niketnilay, I was using option1 before, but since I need to send mail to those who are in the search results, while it looks like option1 only support the pre defined recipients. So I used below way in the search, and run it as hourly. | eventstats values(username) as recipients values(FULL_NAME) as _FULL_NAME | eval _recipients=mvjoin(_recipients, ",") | sendemail to=$result._recipients By using your option2 suggestion, actually there are some entries over 5 counts, but it doesn't send out mail. No results found. ... View more

Yes, I am going to only send one mail with multiple recipients to avoid too much duplicated mails. :) ... View more

Thanks xpac, it works well!!! I will setup an alert or report using this search query. However it will be a little different as what I setup it in the alert trigger threshold that if the result is over 1, Splunk will send mail out. By using this way, looks like Splunk will send out even the result is 0, but I will try to figure that out. ... View more

Thanks xpac, it should be working, I remove the sendemail part to the test first, looks good. But by adding | stats values(username) as recipients, the table will be changed as well. Is there a way to keep below search result which I need to put it into the mail body? No. username Site 1 a A 2 b B ... View more

missed some comments that if the vaules are comined, then I can send mail to them in one mail, in the to list, it is "a;b" ... View more

Thanks woodcock, I used "| rex max_match=0 field=_raw "(?)Dest : (?.*)" | table path" in the end, but your suggestion to use "max_match=0" really helps! ... View more