This should work: ... | lookup division_email_list division OUTPUT division_email_address | sendemail to=division_email_address format="html" server=smtp.gmail.com:587 use_tls=1 Take a look at the python script $SPLUNK_HOME/etc/apps/search/bin/sendemail.py for other keyword arguments you can use with sendemail command. ... View more

You outputs.conf does not look right to me. There are 3 levels of config you can apply in outputs.conf. Global, Target Group and Single Server. You only have a global stanza. The setting defaultGroup defines the "name" of the default "Target Group", which you have not yet defined. Try this: # GLOBAL CONFIG [tcpout] # Name of the default Target Group defaultGroup = loadBalancedGroup disabled = 0 # TARGET GROUP CONFIG # Define a target group called "loadBalancedGroup" [tcpout:loadBalancedGroup] # Specify members of new target group server=10.28.204.212:9997, 10.28.204.213:9997 # SINGLE SERVER CONFIG [tcpout-server://10.28.204.212:9997] # SINGLE SERVER CONFIG [tcpout-server://10.28.204.213:9997] ... View more

I'm not sure what you are trying to do here. What do you mean you cannot "eval" a field that has been extracted with Rex. Eval creates a new field based on evaluating something. You are simply assigning to a field that has the same name as the extracted field. Does the following work? | eval newfield=fsprhr What are you trying to do with Eval? ... View more

You are missing a slash after the %d and before %m in your first post. I always use %Y for four-digit year and %y for two-digit year. %d is always zero-padded (03/07/12) %e is space-padded ( 3/07/12) I would try: %e/%m/%y %H:%M:%S OR %e/%m/%y %T ... View more

Yes it seems that the 's' modifier is on by default which has the effect that '.' will match new-lines. You can selectively turn off any of the 4 modifiers by prefixing them with a '-'. Just to be clear, the 'm' modifier changes the behaviour of the anchors '^' and '$'. When 'm' is off, '^' means match the beginning of a string and '$' means match the end of a string. If the string happens to be a multi-line event then '^' matches the start of the event and '$' matches the end of the event (not the end of a line). With the 'm' modifier turned on '^' matches the start of a line and '$' matches the end of a line. So '(?m)^foo.*bar$' will match the word 'foo' at the beginning of any line and then zero of more characters up to the string 'bar' at the end of the line (just before a newline character). If you want '.' to match across multiple lines you use the 's' modifier. So '(?sm)^foo.*bar' will match the word 'foo' at the beginning of any line and then zero or more characters (including newline characters) greedily until it finds the word bar at the end of a line. Spunk appear to have switched on the 's' modifier in 4.3? so that '.*' is always matching newlines. To turn this behaviour off and restore the default for PCRE you need to use the '-s' notation. So to turn on multi-line matching and turn off single-line mode you would say '^(?m-s)foo.*bar' ... View more

If the header row is in an event of its own, then use a Transform to send it to the Null Queue. Else If the header row is in a multi-line event, use SEDCMD to strip it out. Option 1 is documented here: http://docs.splunk.com/Documentation/Splunk/4.3/Deploy/Routeandfilterdatad#Filter_event_data_and_send_to_queues Option 2 is documented here:http://docs.splunk.com/Documentation/Splunk/4.3/Data/Anonymizedatausingconfigurationfiles#Through_a_sed_script Oh sorry I notice that this is after using outputcsv! No you cannot do it. ... View more