hello,
sendemail can not work variable fields.
example,
index=mail
| table id domain
| eval email=id."@abc.com"
| sendemail to="$email$" subject="test" sendresult=true inline=true message="test"
>> command="sendemail", {} while sending mail to:
index=_internal email
>> ERROR sending email. subject="test", results_line="None", recipients="[]", server="localhost"
why can't I identify my email address?
it works normally when i enter email address.
The way you are using it, $email$ is notation for a token, not a field - have you tried
| sendemail to=email subject="test" sendresult=true inline=true message="test"
The following information is output:
before: ERROR sending email. subject="test", results_line="None", recipients="[]", server="localhost"
after: INFO sending email. subject="test", results_line="None", recipients="[email]", server="localhost"