Alerting

How to run a scheduled reports but only if the search contains results?

stakor
Path Finder

I am looking to run a scheduled report, but I would like to only receive an email if the search powering the report has found something.

Can one accomplish such a thing?

If you are looking for people who visit test[.]com, and in the last week (Duration of the search), no one has gone there, then there should be no email. If someone has gone to test[.]com in the last week, then it should list their name, and send an email.

I don't know if conditional sending is available in Splunk or not.

0 Karma
1 Solution

jonmargulies
Path Finder

Change it to an alert. An alert in Splunk is basically just a report but with conditionals like the one you're talking about. One of the simplest ways to set an alert is to only email if the number of results is >0.

View solution in original post

jonmargulies
Path Finder

Change it to an alert. An alert in Splunk is basically just a report but with conditionals like the one you're talking about. One of the simplest ways to set an alert is to only email if the number of results is >0.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...