topic Re: Send email alerts in gz format in Alerting

Send email alerts in gz format

dsmc_adv — Tue, 29 Sep 2020 19:15:43 GMT

I want to get more than 10000 results and after reading some answers about the limits in the email and I realized that if I bump from 10000 to 500000 results I will have a huge file that I will not be able to send by email. So I started to attack this.

My first thought was to directly send with a custom alert action. A ptyhon script that emails the results_file through as is easy accessible by the results_file payload but this gives me raw results that I will have to parse (how?). The other alternative is to modify the default email script for my specific app. Any advice ?

Is strange that the default email action only sends plain csv files and not give the option of compressing it.

Re: Send email alerts in gz format

burakcinar — Thu, 26 Apr 2018 10:27:45 GMT

I'm not sure about exact answer but there's another nice app on splunkbase, it might help you. you can export splunk data to google spreadsheet and create alert..

Google Import/Export
https://splunkbase.splunk.com/app/2630/

Re: Send email alerts in gz format

dsmc_adv — Thu, 26 Apr 2018 10:51:32 GMT

This app involves lookups and if I add a lookup with a 500000 results the bundle size would be affected, but thanks

Re: Send email alerts in gz format

woodcock — Thu, 26 Apr 2018 14:33:17 GMT

It is very easy to run a splunk search from the CLI. Just login to CLI on your search head, and do this:

$SPLUNK_HOME/bin/splunk "your search here" > YourFileHere
tar czvf YourFileHere.tgz ./YourFileHere
YourCommandHereToSendEmail

You can put this in a script and then cron it.

Re: Send email alerts in gz format

dsmc_adv — Thu, 03 May 2018 16:36:15 GMT

That would be super easy for me that I have rights to access with the splunk cli but the user, who defines the search in the ui and wants to get the results doesn't.

Re: Send email alerts in gz format

woodcock — Thu, 03 May 2018 18:42:33 GMT

You will have to build your own modular alert to do this. It would be REALLY easy and make a fine project for an intern. I checked and I could not find anything on SplunkBase to do this, but maybe you search better than I do.

Re: Send email alerts in gz format

dsmc_adv — Tue, 05 Jun 2018 16:59:35 GMT

I finally created my own app with a script that reads the results_file, cleans the metadata columns, creates a gzip and attaches it to an email. The recipients can be configured with a defined user interface:

https://github.com/rmacian/splunk-gzip-alerts