topic Re: Add search results to lookup AND send entire lookup by email in Splunk Search

How do I add search results to lookup AND send entire lookup by email?

spadler — Fri, 16 Sep 2022 14:51:18 GMT

I was asked to archive search results in a CSV then send those results periodically by email. My solution is to do this in 2 reports. The first report runs the search and appends the results to a lookup. The second just grabs the entire lookup (| inputlookup my_lookup.csv) then emails the results as a CSV.

This seems to work fine but I feel like there should be a more elegant solution, like in only one search/report. I'm curious about what others think.

Re: Add search results to lookup AND send entire lookup by email

gcusello — Fri, 16 Sep 2022 13:44:04 GMT

Hi @spadler,

the searches in both report and add lookup I suppose are the same.

So you could run your search in an alert, sending the csv as attachment and adding at the end of the search the outputlookup command that saves the search results in a lookup.

In this way you have with one search both the lookup and the attachement because the outputlookup doesn't change the results to send as alert attachement.

Ciao.

Giuseppe

Re: Add search results to lookup AND send entire lookup by email

schose — Fri, 16 Sep 2022 13:45:12 GMT

hi,

This sounds like a working solution. Me personally would first try to create an alert instead of report and set the trigger to "send email" there you can select "attach CSV".. should do the same with one object to maintain.

best regards,

Andreas

Re: Add search results to lookup AND send entire lookup by email

spadler — Fri, 16 Sep 2022 15:22:20 GMT

I tried your suggestion with the following in an alert. While it performs the search, updates the lookup, and sends the lookup CSV by email, it overwrites the lookup data. I need it to append the latest search results to the lookup, then send the updated CSV by email.

MY_SEARCH |timechart span=10m count BY status | outputlookup my_lookup.csv

Re: Add search results to lookup AND send entire lookup by email

gcusello — Fri, 16 Sep 2022 15:32:24 GMT

Hi @spadler,

please try this:

Otherwise, the only solution is two different objects.

Ciao.

Giuseppe

Re: How do I add search results to lookup AND send entire lookup by email?

nyc_jason — Sat, 17 Sep 2022 05:45:42 GMT

If you have outbound mail setup you can use |sendmail after the outputlookup. This this works for me, and Im able to receive csv files attached that were produced by the outputlookup:

mysearch | outputlookup mylookup.csv | sendmail to="abc@xyz.com" sendcsv=true

See these docs:

https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Sendemail

https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Sendemail