Splunk Search

sendemail for each search result values with 20 line body content

shrinivaskittur
Explorer

Hi,


I have a requirement where my search displays the below result and the out is stored in CSV


Now in another query I am inputting the CSV from the first search and trying to send an email for each filed value of "email_ID" with 20 line email body content, I have tried with the below query (without a email body as I don't know how to insert 20line email body ) but it is giving me an error.
Also, please help me with how to insert 20line email body
Search result :

     email_ID                    Head_ID

-----------------------------------------

abc@abc.com           abc_head@abc.com

shri@abc.com           shri_head@abc.com

xyz@abc.com           xyz_head@abc.com

 

query :

| inputlookup email_ID.csv append=t | fields email_ID Head_ID  | sendemail from="emailaddress@abc.com" to="$email_ID$" cc="$Head_ID $" subject="emailtest" sendresults=true inline=true

query  error: 

  • command="sendemail", {} while sending mail to:
Labels (1)
Tags (1)
0 Karma

burwell
SplunkTrust
SplunkTrust

Hello. If i understand your requirement you want to run one search and send to different email addresses.

There's a handy splunkbase app sendresults: https://splunkbase.splunk.com/app/1794/

You might be interested in using it.

0 Karma

shrinivaskittur
Explorer

Hi,

Thank you for reply...

Yes, I need to run a search then send email to searched values, for example my search result is looks like below and I want to pickup each email_ID mentioned in table and send it separate email for each Email ID.

     email_ID                    Head_ID

-----------------------------------------

abc@abc.com           abc_head@abc.com

shri@abc.com           shri_head@abc.com

xyz@abc.com           xyz_head@abc.com

 

in short considering above is my search result and I want to send 3 separate email to each email_ID ,i.e., abc@abc.com , shri@abc.com and xyz@abc.com 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...