Hi.
I tried to send an email for each event when triggered. I used `map` and `sendemail` commands, but there is an empty email always sent out, regardless if there is any event found. How can I stop sending an empty email? Thanks.
index=xyz user=U12345 OR user=X12345
| table _time hostname user
| eval report_time=strftime(_time, "%d %b %Y %H:%M:%S")
| eval subject=$report_time$ + ", user, " + $user$ + " logged on to server " + $hostname$
|stats count by subject
| map [ search | eval subject=$subject$ | stats count by subject | fields - count | sendemail server=mail.server.net from=xyz to=abc subject=$result.subject$ sendresults=true]
↧