Splunk Search

SendEmail command to send to different emails

nols76
New Member

Hello all. New to splunk. How can I perform a SendEmail for each log that comes in, which will have a different email address for each?

 index=wm_xsp_cad host=vxxx0u8997 "inactive team" index=wm_xsp_cad host=vxxx30u8997 "Inactive team"|table TeamEmail, ECI, CADesc | eval valueForToHeader=TeamEmail | sendemail 
   sendresults=true inline=true
   to= ????
    Subject=\"$CADesc\$\" 
     From="james@jL.com"

     Subject="hello"
     server= localhost
     graceful=false
Tags (1)
0 Karma

nols76
New Member

Thank you, this is helpful

0 Karma

Yorokobi
SplunkTrust
SplunkTrust

Take a look at the Sendresults search command: https://splunkbase.splunk.com/app/1794/

0 Karma

nols76
New Member

Making some progress with this however I need assistance with sending one email per record, rather than one email for all the records?

index=wm_xsp_cad host=vxxx0u8997 "inactive team" index=wm_xsp_cad host=vxxx30u8997 "Inactive team"|table TeamEmail, ECI, CADesc | eval valueForToHeader=TeamEmail | sendemail 
  sendresults=true inline=true
  to= ????
   Subject=\"$CADesc\$\" 
    From="james@jL.com"

    Subject="hello"
    server= localhost
    graceful=false
0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...