Splunk Search

Sendemail query: How to send email to individual owners with servers details, who's status is shown as "MISSING"?

raomu
Explorer

Hello,

I have a resultant data like this:

Server Name    Status      Location      Owner   Email Id 

A-Z1           Missing.    Spain.          AAA        AAA@domain.com
A-Z2           Active      Japan           BBB        BBB@domain.com
A-Z3           Missing     Japan           CCC.       CCC@domain.com

I want to send email to individual owners with servers details, who's status is shown "MISSING"

0 Karma

elliotproebstel
Champion

This should get you started:

[ your current search ]
| search Status="Missing"
| map 
 [| sendemail to="$EmailID$" subject="subject line" from=youremail@whatever.com message="Your server status is MISSING"  ]

This is an adaptation from an old post: https://answers.splunk.com/answers/186045/how-can-i-use-a-combination-of-map-and-sendemail-t.html

0 Karma

thambisetty
SplunkTrust
SplunkTrust

I tried its not working

getting below warning

2020-04-26 16:52:22,953 +0400 WARNING sendemail:1505 - search results is empty, no email will be sent

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...