Alerting

How to schedule a report to send an email only if it returns results.

Communicator

I have a report that sends an email with the result data once a day. I only want the report to send an email if the number of results > 0. Can anyone point me in the right direction?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

run your search -> top right save as dropdown -> an alert -> condition: if count > 0 -> in actions, send results, send email (and everything else you need) -> set cron to the time of day you want the report to run -> save -> enjoy
hope it helps

View solution in original post

0 Karma

Explorer

A little late, but you can go to Settings\Searches, reports, and alerts

Click your report and in the Alert section you can choose the Condition, the one you want is:

If number of events
is greater than: 0

Source: https://answers.splunk.com/answers/586680/report-creates-multiple-emails-looking-for-single.html

0 Karma

SplunkTrust
SplunkTrust

run your search -> top right save as dropdown -> an alert -> condition: if count > 0 -> in actions, send results, send email (and everything else you need) -> set cron to the time of day you want the report to run -> save -> enjoy
hope it helps

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

If you change the report into an alert you'll have the ability to send email only if there are results.

---
If this reply helps you, an upvote would be appreciated.

Communicator

That was it. Thanks

0 Karma

SplunkTrust
SplunkTrust

Please accept an answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!