I would try scaling the data first then visualizing the scaled data: | eval scaledData = log(data, 10) ... View more

To answer my own question, I had to do this through a custom python script that loops through email fields, then calling the sendemail command in each loop with the email address as input. This actually works. Caveat is that when calling the sendemail command through the python script, you need to be authenticated through the commandline. I created a Splunk-only (not LDAP) user with limited capabilities that gets authenticated each time the script is called using the auth tag. Per request, here's the skeleton of the implementation (note, on Splunk 5): In Splunk manager, set up the scheduled search "whatever search that gets you the email addresses you want" | eval toEmail=fieldWithEmail | emailto On the server, in bin (I forget the precise details of how to get the script to get recognized, but I recall having to change permissions), create emailto.py with your custom bin locations and such: # this comment is here bc i couldnt figure out how to get code formatting to work otherwise import splunk.Intersplunk import subprocess from subprocess import Popen, PIPE, STDOUT class CustomEmail: def init(self, to_email): self.to = to_email def send_email(self): cc = 'some_email@to_be_cc_ed.com' command = 'YOUR_APP_DIR/bin/custom_email.sh %s %s' \ % (self.to, cc) output = 'none' try: p = Popen(command, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=True) output = p.stdout.read() if output == '': print p.stderr.read() except e: print e print('________________________________________________') print('Custom email ran for: %s' % self.to) print(output) return 'success' Get the previous search results (results, _, _) = splunk.Intersplunk.getOrganizedResults() Process each result for result in results: ce = CustomEmail(result["toEmail"]) try: result["emailResults"] = ce.send_email() except Exception, e: print(str(e)) Now write the shell script custom_email.sh contains the search that you want to run to be sent to the individual. It's first argument is the to email, and the second is the cc email. Play around with it to test outside of production. Having a hard time with code-formatting, so block quoting here... export HOME=/opt/splunk /opt/splunk/bin/splunk login -auth dummyuser:somepassword /opt/splunk/bin/splunk search "sourcetype=\"whatever\" $1 earliest=-24h@h | sendemail to=\"$1\" bcc=\"$2\" from=\"from_address@you_re_using\" subject=\"Custom Email Report for $1\" sendresults=true" ... View more