Using Splunk to send custom emails to a large number of users

[rturk]

Hi Splunkers!

Has anyone had any experience using Splunk to send a large number (1000+) of emails. The scenario I'm thinking of is say to send data usage reports (generated by Splunk) to a large number of users, where they are given a report showing their total usage for the period, and a link to log into Splunk to get the finer details.

Just putting this out there to see what anyone else might have done.

Cheers!

RT

[martin_mueller]

You could consider doing something roughly like this:

base search computing usage reports, one row per user | map maxsearches=1000 search="stats count | eval field1 = \"$field1$\" | eval field2 = \"$field2$\" | ... | sendemail subject=\"$subject$\" to=\"$to$\" ... "

Your base search would have to produce subject lines, receiver mail addresses, the whole nine yard. The mapped search would create a single dummy event using stats, copy over fields you want to include, and send out the email.

I'm not quite sure if this is feasible for 1000+ emails though... but probably more feasible than maintaning 1000+ individual alerts.

[linu1988]

Hello,
It is possible. I suppose it's 1000 users at once rather sending one by one. And if you are going to send them at once they how are you planning to hide the details from user to user. And there is no issue with privacy you could go for s distribution list with all the users in it. How will you manage them if you put them in a conf file! So the information in the question is very less what exactly the email is and how is it going to be sent with which data? Let us know if you still need any help

Thanks