Splunk Search

How do I add a string in the title of a e-mail?

avneet26
Engager

"user-info"
index=user_interface_type sourcetype=* 
| table _time, host, port, _raw | sendemail to="abc@splunk.com" sendresults=true

I use above query to list out the details for the search "user-info"

I want to use this string "user-info" and pass it on in the title of the e-mail as : Notification received for user-info

How to do that ?

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If user-info is a string literal then include it as the value of the subject argument to sendemail.

"user-info" index=user_interface_type sourcetype=* 
| table _time, host, port, _raw 
| sendemail to="abc@splunk.com" sendresults=true subject="user-info"
---
If this reply helps you, Karma would be appreciated.
0 Karma

avneet26
Engager

But i Want to add the subject as "Notification received for <then the string that I searched in the query">

0 Karma

richgalloway
SplunkTrust
SplunkTrust
| sendemail to="abc@splunk.com" sendresults=true subject="Notification received for user-info"

There is no back-reference to string literals.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...