All Apps and Add-ons

Sendresults command strips carriage return. How to add the line break back into my results when sending the email?

robert_miller
Path Finder

I am running a stats query using the example command below. For this example, "field2" is a multivalue field. When not including the sendresults command, I am able to see the groupings where field2 has a carriage return. (which is what I want)

stats list(field1), list(field2) by manager, fullname

manager1 fullname1 field1 field2
manager2 fullname2 field1 field2A
field2B
manager2 fullname3 field1 field2

However, when adding the sendresults command to the end of that query, the carriage return is removed and my results in field2 are now separated by a space.

stats list(field1), list(field2) by host, os | eval email_to=manager | sendresults ...

manager1 fullname1 field1 field2
manager2 fullname2 field1 field2A field2B
manager2 fullname3 field1 field2

Any idea how to add the line break back into my results when sending the email?

Thanks

0 Karma

mockd
Path Finder

We have sorted out what the issue is and will be releasing an updated version of the command soon.

0 Karma

robert_miller
Path Finder

Have you had any luck? Thanks.

0 Karma

mockd
Path Finder

It's most likely caused by newlines and the HTML used to render the email message. I will do some testing and get a more formal answer.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

I can find documentation for sendresults. I'm wondering, are you using the sendemail command ?

0 Karma

robert_miller
Path Finder

I am using the App sendresults. Below are the variables I am using. This will recurse through my results and email each manager their employee results.

| eval email_to=manager | sendresults subject="Test." showemail=f

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...