Hey Kays,   There is a cool presentation notes from Splunk conf19 that has a nice architecture review, you can check it here: https://conf.splunk.com/files/2019/slides/SEC1709.pdf ... View more

Hey @pstamati, Not a fan of this way of doing it,  used  only few times in the past,  methodology is below: 1. Run your search and save results to a csv (say using outputlookup). (Report 1) 2. Create a second search with inputlookup: (Report 2) | inputlookup your_saved_results.csv | table DEVICE_TYPE VULNURABLE_COMPONENT COUNT recipient | dedup recipient | fields recipient | map search="|inputlookup your_saved_results.csv |search recipient=$recipient$ | table DEVICE_TYPE VULNURABLE_COMPONENT COUNT recipient | sendemail to=$recipient$ subject=\"Check this out\" message=\"Not a very easy command.\" sendcsv=true sendresults=false paperorientation=landscape" maxsearches=100 Where maxsearches number would be a max row value that your csv could possibly be (max result number). Two searches/reports method is optional in case your main query is lightweight. I mean if it takes seconds to run you could replace <inputlookup> and use query instead all in one report. Hope I didn't overcomplicate things. ... View more

Hello @pstamati, In order to use sendemail you would need to use map command and iterate through batch of results, it is possible but more complicated. What I would suggest is use sendresults app for Splunk, than you would do: <your SPL> | table DEVICE_TYPE VULNURABLE_COMPONENT COUNT recipient | eval email_to=recipient | eval email_subj="My subject here" | eval email_body="Email body goes here" | fields -recipient ```This to not send email as a column``` | sendresults sender="foo@bar.com" showemail=f showbody=f showsubj=f showfooter=f  This will combine and send results to each separate recipient.  *You can also add formatting with HTML in the footer and body etc. (check doc for further info) ... View more