topic Re: Splunk Report Delivery in Splunk Enterprise

Splunk Report Delivery

Roy_9 — Tue, 31 Dec 2024 19:19:30 GMT

Hello,

I have a report scheduled every week and the results are exported to pdf's. Is there an option to NOT email if no results are found because sometimes these PDF's have nothing in them.

Thanks

Re: Splunk Report Delivery

richgalloway — Tue, 31 Dec 2024 21:56:15 GMT

There is no such option because reports are sent unconditionally.

If you wish to send email only when there are results then consider changing the report to an alert.

Re: Splunk Report Delivery

Jawahir — Fri, 03 Jan 2025 18:08:44 GMT

You can achieve this by using the sendemail command.

Rather than setting email as an action, you can incorporate the sendemail command directly into your search query, configuring it with the necessary parameters.

Example

<yoursearch> | sendemail to=example@splunk.com server=mail.example.com 
subject="Here is an email from Splunk" message="This is an example message" 
sendresults=true inline=true format=raw sendpdf=true

------

topic Re: Splunk Report Delivery in Splunk Enterprise

Splunk Report Delivery

Re: Splunk Report Delivery

Re: Splunk Report Delivery

If you find this solution helpful, please consider accepting it and awarding karma points !!