for each result would send many emails to one receiver, and we want send subset result to different user, so this may not help ... View more

hi Martin, i am using map along with the sendemail, but Spluk gives me a authentication error like below. but it works fine if I only use sendemail, some blog said the subsearch lost the session, do you have any idea to fix this? or which version you are running on? i am on 8.0.1 endemail:1454 - [HTTP 403] Client is not authorized to perform requested action; File "/opt/splunk/etc/apps/search/bin/sendemail.py", line 1447, in <module> results = sendEmail(results, settings, keywords, argvals) File "/opt/splunk/etc/apps/search/bin/sendemail.py", line 403, in sendEmail jobResponseHeaders, jobResponseBody = simpleRequest(uriToJob, method='GET', getargs={'output_mode':'json'}, sessionKey=sessionKey) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 559, in simpleRequest raise splunk.AuthorizationFailed(extendedMessages=uri) AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action;   ... View more

it could work sometimes, but it does not support CSV attachment, a larger table in an email is not good, better to find why we have the authentication issue and use the Splunk sendemail  ... View more

does this finally work? i have a similar query to trigger the sendemail inside the map command, but I got "2021-04-30 04:05:59,276 +0000 ERROR sendemail:1428 - [HTTP 403] Client is not authorized to perform requested action" error in index=_internal source=*python.log*, but the sendemail works if I run separately, some post said the script inside map missed the context, do you know how we could fix this?  ... View more

i am a admin user and follow the similar query, but I got "sendemail:1428 - [HTTP 403] Client is not authorized to perform requested action" when run sentemail inside the map command, the email could be send if I run it seprartely. do you know how to avoid this?   ... View more

and you got a fix for this? i am getting the same issue ... View more

attached the solution which worked for the event index https://community.splunk.com/t5/Dashboards-Visualizations/Limit-how-far-back-you-can-retrieve-data-regardless-of/td-p/51257 ... View more