Alerting
Highlighted

How to schedule a report to send an email only if it returns results.

Communicator

I have a report that sends an email with the result data once a day. I only want the report to send an email if the number of results > 0. Can anyone point me in the right direction?

0 Karma
Highlighted

Re: How to schedule a report to send an email only if it returns results.

SplunkTrust
SplunkTrust

If you change the report into an alert you'll have the ability to send email only if there are results.

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: How to schedule a report to send an email only if it returns results.

Communicator

That was it. Thanks

0 Karma
Highlighted

Re: How to schedule a report to send an email only if it returns results.

SplunkTrust
SplunkTrust

Please accept an answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to schedule a report to send an email only if it returns results.

SplunkTrust
SplunkTrust

run your search -> top right save as dropdown -> an alert -> condition: if count > 0 -> in actions, send results, send email (and everything else you need) -> set cron to the time of day you want the report to run -> save -> enjoy
hope it helps

View solution in original post

0 Karma
Highlighted

Re: How to schedule a report to send an email only if it returns results.

Explorer

A little late, but you can go to Settings\Searches, reports, and alerts

Click your report and in the Alert section you can choose the Condition, the one you want is:

If number of events
is greater than: 0

Source: https://answers.splunk.com/answers/586680/report-creates-multiple-emails-looking-for-single.html

0 Karma