Alerting

How to schedule a report to send an email only if it returns results.

matstap
Communicator

I have a report that sends an email with the result data once a day. I only want the report to send an email if the number of results > 0. Can anyone point me in the right direction?

0 Karma
1 Solution

adonio
Ultra Champion

run your search -> top right save as dropdown -> an alert -> condition: if count > 0 -> in actions, send results, send email (and everything else you need) -> set cron to the time of day you want the report to run -> save -> enjoy
hope it helps

View solution in original post

0 Karma

L1_marrera
Explorer

A little late, but you can go to Settings\Searches, reports, and alerts

Click your report and in the Alert section you can choose the Condition, the one you want is:

If number of events
is greater than: 0

Source: https://answers.splunk.com/answers/586680/report-creates-multiple-emails-looking-for-single.html

0 Karma

adonio
Ultra Champion

run your search -> top right save as dropdown -> an alert -> condition: if count > 0 -> in actions, send results, send email (and everything else you need) -> set cron to the time of day you want the report to run -> save -> enjoy
hope it helps

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you change the report into an alert you'll have the ability to send email only if there are results.

---
If this reply helps you, Karma would be appreciated.

matstap
Communicator

That was it. Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please accept an answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...