The caveat of this is that the email address must exist in the resultset, otherwise it assumes it's null. This means all your emails will have the field "valueForToHeader" at the end of all the columns. Could be worse, but could be much better. If, in the case that you don't want to email if there are no results, you don't even need to put in an if statement. If there are no events, there can be no event where you can eval a value to a field -- therefore it will still try to send as null. Tested the following scenarios: | makeresults | eval to_address="test_address@company.com" | sendemail to=$result.to_address$ subject="Test Email" This works | makeresults | eval to_address="test_address@company.com" | table _time | sendemail to=$result.to_address$ subject="Test Email" This does not work (null to address) | makeresults | eval to_address="test_address@company.com", temp="something" | search temp="somethingelse" | sendemail to=$result.to_address$ subject="Test Email" This does not work (null to address) ... View more

You will need to make an adjustment to fields.conf on the search head. Setting the INDEXED_VALUE to false should allow you to search on the extracted fields without the wild card. If one does not exist, you will want to create a fields.conf in $splunkhome/etc/system/local and add the below stanza to it. [ertyuio or whatever your extraction is named.] INDEXED_VALUE=false This should then allow the env=ertyuio search to return results. Below is a link to the docs page for fields .conf http://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Fieldsconf This is what we are changing, it is a bit counter intuitive, though ertyuio is in the event, since it is part of a word and does not exist exactly as "ertyuio" we want to set it as false as it does not count as being part of the raw text in the event. INDEXED_VALUE = [true|false||] * Set this to true if the value is in the raw text of the event. * Set this to false if the value is not in the raw text of the event. Give that a try for me if you can and let me know your result. It works in my test environment. ... View more