topic Re: Splunk report on demand in Reporting

Splunk report on demand

SS1 — Thu, 17 Jun 2021 22:57:15 GMT

Hi,

I have a report which is scheduled to run every day at 8 AM.

Is it possible to generate that report to email address X by executing a command via CLI ?

Re: Splunk report on demand

venkatasri — Fri, 18 Jun 2021 01:20:24 GMT

Reports functionality having trigger action Email is one of the action if you want to enable then at 08 AM you will get Email. In UI go to Edit -> schedule -> trigger Actions -> Email and fill in details required and check the additional options like send pdf, results etc.

Just wondering why you want to push it from CLI is this for ad-hoc basis rather than every days 08 AM?

Backed savedsearches.conf looks like this,

## cron is indicaive [your_saved_search_report_name] action.email = 1 action.email.sendpdf = 1 action.email.sendresults = 1 action.email.to = youremails@domain.com alert.track = 0 cron_schedule = 0 6 * * 1 enableSched = 1

---

An upvote would be appreciated if it helps!

Re: Splunk report on demand

SS1 — Fri, 18 Jun 2021 01:40:44 GMT

Just wanted to see if i can issue a command via CLI at 8:15 AM and generate that report ?

Re: Splunk report on demand

venkatasri — Fri, 18 Jun 2021 03:32:58 GMT

Hi @SS1

can be achieved if you have _audit index access to query it using Splunk Rest API and having mail functionality enabled.

#Step1 - Find the search_id of savedsearch index=_audit savedsearch_name=<your_search_name> earliest=-20m latest=now | field search_id | Rest API POST method -https://docs.splunk.com/Documentation/Splunk/8.2.0/RESTREF/RESTsearch#search.2Fjobs #Step2 get the results of step1 to retrieve search_id Rest API GET method -https://docs.splunk.com/Documentation/Splunk/8.2.0/RESTREF/RESTsearch#search.2Fjobs #Step3 retrieve the search job results of savedsearch REST API GET Method - https://docs.splunk.com/Documentation/Splunk/8.2.0/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7D.2Fresults -> output the results to a file #Step4 use the linux sendmail command to send results to your required email, assuming you have SMTP enabled in linux

-----

An upvote would be appreciated and accept solution if it helps!