How do you send an email alert based on search results?

[AKG1_old1]

Hi,

I am using a saved search and looking to send an email alert to multiple recipients based on search results (with results in the message body).

Based on referring similar posts, I came up with this query, but the issue is I am not getting any results in the email body, and also, this will send multiple mails to the same user(same email may configured in multiple lines). I'm looking for consolidation of results based on email address.

Query:

<basesearch>| table  Time  Context+Command Elapsed  EMAIL  |map search="| sendemail to=$EMAIL$ format=table sendresults=true inline=true"

OR

If I can consolidate all configured emails and send the full list for results to all recipients as CC, that will work too.

I don't know if this works.

 | eventstats list(EMAIL) as EMAIL

Related post used for reference:

https://answers.splunk.com/answers/401081/how-to-use-the-sendemail-command-to-send-an-email.html

https://docs.splunk.com/Documentation/Splunk/6.5.2/Alert/Emailnotification#Send_email_to_different_r...

thanks

[sirajnp]

It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result.

https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_r...

[gjanders]

Refer to the SplunkBase app sendresults that is probably a better match for this use case.
If you refer to the details tab it allows you to customise the email_to among other variables such as the body of the email based on your search results (by using eval statements)

[skoelpin]

Are you wanting to send an email based off the results of a different search or the inline search with thesendemail command?

If the former, it would go like this

1) Create a conditional search
2) If this alert fires, then it triggers an alert action which dispatches another search
3) The search that was dispatched will have the sendemail command

[AKG1_old1]

Thanks for reply. I am using only 1 search and it produce list of results and each row have email value as described in attachement. There could be many different email address. I have two option here

1) Either send email for each row but in this case multiple email will be sent if same email specified in multiple rows. unless there is some way to consolidate results for each email address.

2) create a list of all email address and send full results to all of them.