Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Why are empty emails being sent using map & sendemail commands in my search and how do I prevent this?

$
0
0
Hi. I tried to send an email for each event when triggered. I used `map` and `sendemail` commands, but there is an empty email always sent out, regardless if there is any event found. How can I stop sending an empty email? Thanks. index=xyz user=U12345 OR user=X12345 | table _time hostname user | eval report_time=strftime(_time, "%d %b %Y %H:%M:%S") | eval subject=$report_time$ + ", user, " + $user$ + " logged on to server " + $hostname$ |stats count by subject | map [ search | eval subject=$subject$ | stats count by subject | fields - count | sendemail server=mail.server.net from=xyz to=abc subject=$result.subject$ sendresults=true]

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>