topic Re: Report is creating multiple emails instead of one in Reporting

Report is creating multiple emails instead of one

mlevsh — Mon, 08 Jun 2020 22:52:16 GMT

We have a report (NOT an alert) that has multiple events as a result of some specific search.
It is scheduled to run every hour and email result of a search.
Instead of the report sending the entire report in one email, it sends an email for each event result

For example:
Result of search on Report via GUI :
user1 locked
user2 locked
user3 locked

Report sends 3 emails with "user# locked" in the body of email

Is there any way to make it to send one email with all events on the result without converting it to an alert?

Thank you

Re: Report is creating multiple emails instead of one

p_gurav — Tue, 13 Mar 2018 04:01:54 GMT

Hi,

This may help you:
https://answers.splunk.com/answers/586680/report-creates-multiple-emails-looking-for-single.html

Also try using sendemail command in search, then schedule report. Refer below command doc:
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Sendemail

Re: Report is creating multiple emails instead of one

mlevsh — Tue, 29 Sep 2020 18:25:35 GMT

@p_gurav
Saw the Q&A at the first link , but it is not really clear what to do. The screen shot is not available on the page , the text advice "-Always in Condition, -Once per search in Alert Mode" doesn't explain what should be changed . For example, there is no alert_mode in Advanced edit of report.

Re: Report is creating multiple emails instead of one

p_gurav — Tue, 13 Mar 2018 13:36:17 GMT

Can you trysendmail command in search itself.

Re: Report is creating multiple emails instead of one

mlevsh — Tue, 29 Sep 2020 18:25:40 GMT

@p_gurav, I think we can use Settings-> Searches, reports, and alerts -> Advanced Edit on Report -> change "alert.digest_mode" from “false” to “true” . It seems to have fixed our issue. At least, for my test.

I compared regular Alert's settings with "Trigger" set to "Once" and "Alert Trigger" set to "For each result" and found that alert.digest_mode is corresponding to Alert Trigger value. On the report that produced multiple emails, alert.digest_mode was set to "false". After changing it to "true" I got just one email

Re: Report is creating multiple emails instead of one

mlevsh — Tue, 29 Sep 2020 18:26:12 GMT

We used Settings-> Searches, reports, and alerts -> Advanced Edit on Report -> change "alert.digest_mode" from “false” to “true” . It seems to have fixed our issue. At least, for my test.

Re: Report is creating multiple emails instead of one

christopherreed — Mon, 13 Apr 2020 17:29:27 GMT

It took a couple of tries for the value to actually set, but once it did it worked perfectly. I needed everything to be sent separately so I set it to false.