Splunk® Enterprise

Search Reference

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF



Emails search results to specified email addresses.


sendemail to=<email_list>

[format= (html | raw | text | csv)]
[inline= (bool)]
[priority= (highest | high | normal | low | lowest)]

Required arguments

Syntax: to=<email_list>
Description: List of email addresses to send search results to.

Optional arguments

Syntax: bcc=<email_list>
Description: Blind cc line; comma-separated and quoted list of valid email addresses.
Syntax: cc=<email_list>
Description: Cc line; comma-separated quoted list of valid email addresses.
Syntax: format= csv | html | raw | text
Description: Specifies how to format the email's contents.
Default: HTML
Syntax: from=<email_list>
Description: Email address for the From line.
Default: "splunk@<hostname>"
Syntax: inline=<boolean>
Description: Specifies whether to send the results in the message body or as an attachment.
Default: true
Syntax: graceful=<boolean>
Description: If set to true, no error is returned if sending the email fails for whatever reason. The remainder of the search continues as if the the sendemail command was not part of the search. If graceful=false and sending the email fails, the search returns an error.
Default: false
Syntax: priority=highest | high | normal | low | lowest
Description: Set the priority of the email as it appears in the email client. Lowest or 5, low or 4, high or 2, highest or 1.
Default: normal or 3
Syntax: sendpdf=<boolean>
Description: Specify whether to send the results with the email as an attached PDF or not. For more information about using Splunk's integrated PDF generation functionality, see "Generate PDFs of your reports and dashboards" in the Reporting Manual.
Default: false
Syntax: sendresults=<boolean>
Description: Determines whether the results should be included with the email.
Default: false
Syntax: server=<string>
Description: If the SMTP server is not local, use this to specify it.
Default: localhost
Syntax: subject=<string>
Description: Specifies the subject line.
Default: "Splunk Results"
Syntax: width_sort_columns=<boolean>
Description: This is only valid when format=text. Specifies whether the columns should be sorted by their width.
Default: true


Example 1: Send search results in HTML format with the subject "myresults".

... | sendemail to="elvis@splunk.com,john@splunk.com" format=html subject=myresults server=mail.splunk.com sendresults=true

Example 2: Send search results to the specified email.

... | sendemail to="elvis@splunk.com" sendresults=true


Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the sendemail command.


This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.2.13, 6.2.14, 6.2.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters