Splunk Search

Sendemail query: How to send email to individual owners with servers details, who's status is shown as "MISSING"?

raomu
Explorer

Hello,

I have a resultant data like this:

Server Name    Status      Location      Owner   Email Id 

A-Z1           Missing.    Spain.          AAA        AAA@domain.com
A-Z2           Active      Japan           BBB        BBB@domain.com
A-Z3           Missing     Japan           CCC.       CCC@domain.com

I want to send email to individual owners with servers details, who's status is shown "MISSING"

0 Karma

elliotproebstel
Champion

This should get you started:

[ your current search ]
| search Status="Missing"
| map 
 [| sendemail to="$EmailID$" subject="subject line" from=youremail@whatever.com message="Your server status is MISSING"  ]

This is an adaptation from an old post: https://answers.splunk.com/answers/186045/how-can-i-use-a-combination-of-map-and-sendemail-t.html

0 Karma

thambisetty
SplunkTrust
SplunkTrust

I tried its not working

getting below warning

2020-04-26 16:52:22,953 +0400 WARNING sendemail:1505 - search results is empty, no email will be sent

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...