Hi,
Below SPL query is returning 41 field values in table but for email notifications when using MAP command, only 10 mails are being generated and getting error while using maxsearches along with the MAP query as
Error in 'map' command: Unable to find saved search 'maxsearches=99'.
The search job has failed due to an error. You may be able view the job in the Job Inspector.
I am able to get only 10 mails when running the below query but actually result counts turns out to be 41.
source="UserList.csv" host="prd-p-bjs8j4b5tcmc" sourcetype="SplUsers" "User Lock Status"=0 "User Type"=A |
rename "User Name" AS user_name, "User Master Maintenance_ User Group" AS user_group, "User Lock Status" AS user_lock_status, "Last Logon Date" AS last_logon_date, "First name" AS first_name, "Full Name" AS full_name, "E-Mail Address" AS e-mailAddress |
eval last_logon_date = strptime(last_logon_date, "%m/%d/%Y") | WHERE
(last_logon_date >= relative_time (now(), "-90d")) AND
(last_logon_date <= relative_time (now(), "-60d")) |
eval last_logon_date = strftime (last_logon_date, "%m/%d/%Y") |
sort 0 + last_logon_date |
table user_name,user_group,first_name,full_name,user_lock_status,last_logon_date,e-mailAddress |
map [sendemail to = $e-mailAddress$ cc="xyz@yahoo.com" subject="User $user_name$ to be locked"
message="Hi $first_name$,
User $user_name$ will be locked as you didn't login to SAP system since 60 days.
Regards,
SAP Admin." sendresults=false footer="Kindly contact SAP Admin if you don't want to be locked within 2 business days."]
Please help to generate all 41 email notifications. Thank you!
... View more