How to schedule a report to send an email only if it returns results.

[matstap]

I have a report that sends an email with the result data once a day. I only want the report to send an email if the number of results > 0. Can anyone point me in the right direction?

[L1_marrera]

A little late, but you can go to Settings\Searches, reports, and alerts

Click your report and in the Alert section you can choose the Condition, the one you want is:

If number of events
is greater than: 0

Source: https://answers.splunk.com/answers/586680/report-creates-multiple-emails-looking-for-single.html

[adonio · Accepted solution]

run your search -> top right save as dropdown -> an alert -> condition: if count > 0 -> in actions, send results, send email (and everything else you need) -> set cron to the time of day you want the report to run -> save -> enjoy
hope it helps

[richgalloway]

If you change the report into an alert you'll have the ability to send email only if there are results.

[matstap]

That was it. Thanks

[richgalloway]

Please accept an answer.