Hi,
I have events as below,
2016-06-29 16:05:13,994 ERROR host=localhost service=check_process state=alert description=Response code from jolokia is not 200. metric=500.0 time=1.467241513994E9 email_id=a@b.com,c@d.com role=node actor_name=test environment=dev
What is the best way to extract email_id and use sendemail to send email with event.
@MuS has the best answer, I have seen to a similar/related question
https://answers.splunk.com/answers/213340/how-to-get-splunk-sendemail-command-to-send-multip.html