Alerting

How to schedule a report to send an email only if it returns results.

matstap
Communicator

I have a report that sends an email with the result data once a day. I only want the report to send an email if the number of results > 0. Can anyone point me in the right direction?

0 Karma
1 Solution

adonio
Ultra Champion

run your search -> top right save as dropdown -> an alert -> condition: if count > 0 -> in actions, send results, send email (and everything else you need) -> set cron to the time of day you want the report to run -> save -> enjoy
hope it helps

View solution in original post

0 Karma

L1_marrera
Explorer

A little late, but you can go to Settings\Searches, reports, and alerts

Click your report and in the Alert section you can choose the Condition, the one you want is:

If number of events
is greater than: 0

Source: https://answers.splunk.com/answers/586680/report-creates-multiple-emails-looking-for-single.html

0 Karma

adonio
Ultra Champion

run your search -> top right save as dropdown -> an alert -> condition: if count > 0 -> in actions, send results, send email (and everything else you need) -> set cron to the time of day you want the report to run -> save -> enjoy
hope it helps

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you change the report into an alert you'll have the ability to send email only if there are results.

---
If this reply helps you, Karma would be appreciated.

matstap
Communicator

That was it. Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please accept an answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...