I'd assume you are using the MAP command to send email per each event from your base search, since I found that you can simply use the sendemail command in your main search without using MAP command. I found the following SPL works when using MAP with sendemail inside. ... your base search ... | table emailaddress ... | map search="|makeresults |sendemail to="$emailaddress$" from="[email protected]" incline=true sendresults=true subject=mysubject message=mymessage" ... View more

SPL for sending email based on email address value in the result: <base search> | table User Email_Address | sendemail to=$result.Email_Address$ subject=$result.User$ ... https://docs.splunk.com/Documentation/Splunk/8.1.2/Alert/EmailNotificationTokens#Result_tokens ... View more

Hi, I ran into the same problem and here is how I get it to work by referencing the Result tokens part in Splunk's documentation.   <Base search> | table User, EmailAddress | sendemail to=$result.EmailAddress$ from="[email protected]" ...     https://docs.splunk.com/Documentation/Splunk/8.1.2/Alert/EmailNotificationTokens ... View more