topic Re: How to avoid sending an empty report? in Monitoring Splunk

How to avoid sending an empty report?

danielbb — Tue, 29 Apr 2025 15:32:13 GMT

Is there a way to avoid sending an empty report? I'm thinking about converting the report to an alert but the customer would like to keep it as a report.

Re: How to avoid sending an empty report?

livehybrid — Tue, 29 Apr 2025 15:38:33 GMT

Hi @danielbb

If you want to be able to conditionally run the email alert action then it needs to be an Alert rather than a report. This allows you to only send if the number of results > 0.

What are the customers reservations about having an alert vs report? They are pretty much the same thing.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: How to avoid sending an empty report?

gcusello — Tue, 29 Apr 2025 15:45:06 GMT

Hi @danielbb ,

instead a scheduled report, use an alert that fires if results is greater than 0.

Ciao.

Giuseppe