https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-an-Email-Report-after-Alert/m-p/607094#M105431 <P>I would like to have a report emailed to me a few minutes after an alert goes off.&nbsp; While the alert can include the results, it is based on something specific and will not have all the information I need.&nbsp; Let's say the alert is set up to catch too many host communication&nbsp; errors to a specific endpoint.&nbsp; Errors&gt;100.&nbsp; Currently I either go to the alert and alter it to make a time chart to see any trends, or go to a specific dashboard that shows communication errors with other endpoints, network status, response times, etc.&nbsp; When the problem goes away I take all the Splunk graphs and make an incident report.&nbsp;&nbsp;</P> <P>I would like to have a report with graphs and other info based on the dashboard emailed to me at the time of the alert and 10 minutes after.&nbsp; &nbsp;Sometimes I can get to my email, but not to Splunk.&nbsp; &nbsp;This would also help with the incident report and make them more uniform.&nbsp;<BR /><BR />Is this possible?&nbsp; I have not worked with reports much.&nbsp; Can a report be triggered by a separate search?&nbsp; I could not find that answer online so I believe it can't.&nbsp; I could write a query that looks at the last time an alert went off and have that trigger the associated report if possible.&nbsp; I would like some type of PDF that I can just attach to the incident report.&nbsp; More importantly I would like to have much more detail emailed to me after an alert.&nbsp; I'm not even sure what an emailed report looks like.&nbsp; I could google that, but If I can't trigger it there is no need for the report.&nbsp; Although in reading about reports I want to use them more with dashboards.&nbsp;</P> <P>Thanks&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</P> Tue, 26 Jul 2022 20:51:24 GMT MScottFoley 2022-07-26T20:51:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-an-Email-Report-after-Alert/m-p/607094#M105431 <P>I would like to have a report emailed to me a few minutes after an alert goes off.&nbsp; While the alert can include the results, it is based on something specific and will not have all the information I need.&nbsp; Let's say the alert is set up to catch too many host communication&nbsp; errors to a specific endpoint.&nbsp; Errors&gt;100.&nbsp; Currently I either go to the alert and alter it to make a time chart to see any trends, or go to a specific dashboard that shows communication errors with other endpoints, network status, response times, etc.&nbsp; When the problem goes away I take all the Splunk graphs and make an incident report.&nbsp;&nbsp;</P> <P>I would like to have a report with graphs and other info based on the dashboard emailed to me at the time of the alert and 10 minutes after.&nbsp; &nbsp;Sometimes I can get to my email, but not to Splunk.&nbsp; &nbsp;This would also help with the incident report and make them more uniform.&nbsp;<BR /><BR />Is this possible?&nbsp; I have not worked with reports much.&nbsp; Can a report be triggered by a separate search?&nbsp; I could not find that answer online so I believe it can't.&nbsp; I could write a query that looks at the last time an alert went off and have that trigger the associated report if possible.&nbsp; I would like some type of PDF that I can just attach to the incident report.&nbsp; More importantly I would like to have much more detail emailed to me after an alert.&nbsp; I'm not even sure what an emailed report looks like.&nbsp; I could google that, but If I can't trigger it there is no need for the report.&nbsp; Although in reading about reports I want to use them more with dashboards.&nbsp;</P> <P>Thanks&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</P> Tue, 26 Jul 2022 20:51:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-an-Email-Report-after-Alert/m-p/607094#M105431 MScottFoley 2022-07-26T20:51:24Z