Splunk Search

How to use the sendemail command to send results to different emails created with eval?

kalianov
Path Finder

Hi splunkers !!! Need help.

I used eval to create a field with the email address for some users:

search myquery.... | fields username, result | eval mail=username+"@mydomain.com"
|sendemail to=mail subject="Splunk is wathing you" sendresults=true
inline=true priority=normal

But it's not working.

In python.log
I want to send emails for all users from my search with specific results for every username from the search.
Is it possible? Can I use "mail" field like variable?

0 Karma
1 Solution

woodcock
Esteemed Legend

As a test, configure your Search Head to use gmail like this:

http://blogs.splunk.com/2014/06/27/splunk-alerts-using-gmail-twitter-phone-calls-and-much-more/

0 Karma

kalianov
Path Finder

I must to use internal email server

0 Karma

afarmer
Explorer

Did you ever get this to work?

0 Karma

sirajnp
Path Finder

It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result.

https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_r...

0 Karma

kalianov
Path Finder

It's a good way but I still have one problem.

my search | stats count(filename) AS files, sum(size) AS TotalMb by user| sort -TotalMb |  eval email=user."@mydomai.com" 
| table user, files, TotalMb, email | head 2 
| sendemail  to=$email$ from=$splunk@mydomain.com$ subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST"

Result is emailed for each user with the same table:
1 user1, 123, 506Mb, user1@mydomai.com
2 user2, 234, 26Mb, user2@mydomai.com

But I need a separate email:
Email1 to user1@mydomai.com
1 user1, 123, 506Mb, user1@mydomai.com
Email2 to user2@mydomai.com
2 user2, 234, 26Mb, user2@mydomai.com

I have tried:

| map search="sendemail  to=$email$ from=$splunk@mydomain.com$ subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST""

but each user receives email with "No results found"

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...