topic Re: Can you compress Splunk reports before sending them as email attachments? in Reporting

Can you compress Splunk reports before sending them as email attachments?

gcusello — Mon, 27 Aug 2018 09:59:11 GMT

Hi at all,
I have the problem that, sometimes, some of my reports exceed the eMail attachment limits.
I could reduce the fields in report, but this isn't a good solution because, in this way, I don't satisfy the final customer and the problem could be still present.
I solved the problem by giving the customer the availability to manually run the report, but the customer wasn't fully satisfied.

Is there a way to compress (zip or tar) a report before sending it to the eMail system?
I think that this is an important feature and that it's strange that nobody has implemented it in Splunk.

Bye.
Giuseppe

Re: Can you compress Splunk reports before sending them as email attachments?

deepashri_123 — Mon, 27 Aug 2018 10:23:09 GMT

Hi cusello,

You can refer this answer and check if that helps!!:
https://answers.splunk.com/answers/140208/how-to-compress-csv-file-and-email-it-on-unix-platform.html

Re: Can you compress Splunk reports before sending them as email attachments?

woodcock — Wed, 05 Sep 2018 01:34:21 GMT

There are other email options. Try this app, for example.
https://splunkbase.splunk.com/app/2614/

Re: Can you compress Splunk reports before sending them as email attachments?

vidhyaArumalla — Wed, 05 Sep 2018 02:26:38 GMT

The above suggestion by @woodcock was something I was looking for long time. Thanks @cusello cuand @woodcock

Re: Can you compress Splunk reports before sending them as email attachments?

Noah_Woodcock — Wed, 05 Sep 2018 02:53:09 GMT

@woodcock provided what I would recommend as well.

Re: Can you compress Splunk reports before sending them as email attachments?

Noah_Woodcock — Wed, 05 Sep 2018 03:18:41 GMT

See if this helps your problem:
https://splunkbase.splunk.com/app/4030/

Re: Can you compress Splunk reports before sending them as email attachments?

gcusello — Wed, 05 Sep 2018 06:39:42 GMT

I have to send a CSV file that is usually too large for eMail attachment, this App is only for pdf.
Is there another solution for csv than to create a script?
Bye.
Giuseppe

Re: Can you compress Splunk reports before sending them as email attachments?

gcusello — Wed, 05 Sep 2018 06:40:06 GMT

I'll try it.
Bye.
Giuseppe

Re: Can you compress Splunk reports before sending them as email attachments?

brolo — Wed, 05 Sep 2018 14:23:22 GMT

Have you tried to go through the REST api?

http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/ExportdatausingRESTAPI

Re: Can you compress Splunk reports before sending them as email attachments?

woodcock — Wed, 05 Sep 2018 15:04:52 GMT

You can bypass email altogether and use scp or other transfer method. Here is what I have done before. First, modify your search to end in | outputcsv MyBigHonkingFile_scpToFileShare.csv. Then setup a cron job on the Search Head to run every hour looking for files that match an arbitrary naming convention like, *_scpToFileShare.csv inside of the $SPLUNK_HOME/var/run/splunk/dispatch/ directory. When a file is found, it is sent via scp to the fileshare, then erased. No email necessary, or, if you like, an email that just says that the file was transferred. Cake.

Re: Can you compress Splunk reports before sending them as email attachments?

Nahra — Tue, 29 Sep 2020 21:10:22 GMT

You could try to use the "Run a Script" option in the Scheduled Report.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Report/Schedulereports#Run_a_script

You could setup a script that would compress the report and then email it via the server's mail application.

Re: Can you compress Splunk reports before sending them as email attachments?

Anam — Mon, 17 Sep 2018 17:17:02 GMT

Hi @cusello

Did any of the answers work for you? If they did please go ahead and accept it and if not let the community know if you need more help/clarification with the problem.

Thanks

Re: Can you compress Splunk reports before sending them as email attachments?

woodcock — Sat, 20 Oct 2018 15:52:25 GMT

My solution bypasses email entirely. I think that you meant to put your comment under a different answer @cusello.