I tried some other "tricks" but nothing seemed acceptable. I'm fairly confident you could do something like this using map. Something like:
<email lookup search> | stats values(email) as to | eval to=mvjoin(to, ",") | map search=" <the real search> | sendemail to=\"$to$\""`
But that gets pretty ugly really quick (especially if you have many double quotes), and there are other limitations too.
I think the only real answer is to make your own email sending search command that can be told to use some sort of field substitution within the "to" field. Which admittedly would be nice and I could that that being helpful for other fields too, like the subject line.
If you want to go down that road, be sure to check out the existing sendemail search command. You can find the existing code here: $SPLUNK_HOME/etc/apps/search/bin/sendemail.py It's probably a better idea to copy this instead of modifying the existing one since it will be overwritten by any splunk upgrades.
