Hi all,
my search | stats count(filename) AS files, sum(size) AS TotalMb by user| sort -TotalMb | eval email=user."@mydomai.com"
| table user, files, TotalMb, email | head 2
Result is:
user1, 123, 506, user1@mydomai.com
user2, 234, 26, user2@mydomai.com
I need to send each row for each of user from search result:
fitst string to user1@mydomai.com
second string to user2@mydomai.com
I am using:
my search | stats count(filename) AS files, sum(size) AS TotalMb by user| sort -TotalMb | eval email=user."@mydomai.com"
| table user, files, TotalMb, email | head 2
| map search="sendemail to=$email$ from=splunk@mydomain.com subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST""
Result is emailed for each user with "No results found". Why are users not receiving emails with the results of the search?
Please help
The map command is used to executed a search (map subsearch) for each result of the base search. Here for each row of base search (those two rows with user1 and user2), the map subsearch (string witing quotes) is "sendemail to=$email$ from=splunk@mydomain.com subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST
", which is not a valid full search and thus the no result found.
Try something like this
my search | stats count(filename) AS files, sum(size) AS TotalMb by user| sort -TotalMb | eval email=user."@mydomai.com"
| table user, files, TotalMb, email | map search="|gentimes start=-1 | eval user="$user$" | eval files=$files$ | eval TotalMb=$TotalMb$ | sendemail to=$email$ from=splunk@mydomain.com subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST""
Skip the entire map
approach. Ground rule: map
is never the answer, there are very very few exceptions.
Instead, configure your alert to send to $result.email$
and to act per event instead of per result. Then you will automagically get two emails.
Requires 6.1 or something similarly old, by now.
The map command is used to executed a search (map subsearch) for each result of the base search. Here for each row of base search (those two rows with user1 and user2), the map subsearch (string witing quotes) is "sendemail to=$email$ from=splunk@mydomain.com subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST
", which is not a valid full search and thus the no result found.
Try something like this
my search | stats count(filename) AS files, sum(size) AS TotalMb by user| sort -TotalMb | eval email=user."@mydomai.com"
| table user, files, TotalMb, email | map search="|gentimes start=-1 | eval user="$user$" | eval files=$files$ | eval TotalMb=$TotalMb$ | sendemail to=$email$ from=splunk@mydomain.com subject="Big files" sendresults=true inline=true priority=normal server="mail.server" message="TEST""