One Report/Alert - broken into multiple emails

[jonbalderston]

I was hoping to do a single search, and from that sent multiple emails based on field (all to same place set up in alert)

i.e. results
user,Group,Owner
user1,Domain Admins,Joe
user1,Sharepoint Users,Paul
user2,Internet Users,Paul
user3,Excange Users,Dave

I want 3 emails sent from that, broken down by owner

email1

user,Group,Owner

user1,Domain Admins,Joe

email2

user,Group,Owner

user1,Sharepoint Users,Paul

user2,Internet Users,Paul

email3

user,Group,Owner

user3,Excange Users,Dave

The result will basically come from a search similar to below

(EventCode=636 OR EventCode=660 OR EventCode=632) | lookup PermissionGroups.csv Target_Account_Name OUTPUT CSV_Priority,CSV_Owner | search CSV_Priority="*" | rename Target_Account_Name AS Group | rename Member_ID as "Account Added" | rename Caller_User_Name AS "Actioning Account" | rename CSV_Owner as Owner |table _time,"Account Added",Group,"Actioning Account",Owner

[jtrucks]

You can do this with a custom script, or you can break this into multiple saved searches with alerting (now called Reports in v6). Without custom scripting, you can't send multiple emails unless you set "Alert Mode" to "Once per result" so it will send an email per result row you have. In your example, that setting would send one message to Joe, two messages to Paul, and one message to Dave. This isn't quite what you described, but it's the closest you can get without writing code or changing your searches.

If you do a script, pull the results file, unzip it in your script (or to an external file), then slurp in the contents to arrays of arrays for easiest data manipulation. You could even key off the name field to create data sets for each name. Then you can iterate through those to send an email with output only for that name. This would give you the exact output you want.

[jtrucks]

In Splunk 6, a report is a saved search that performs an action: AKA an alert. I have external scripts run that pulls the gz of the results, unzips it into memory, sucks the contents into various arrays of arrays, and then parses the output for whatever it needs.

I'll edit the answer to provide some logic for how to accomplish it…

[jonbalderston]

I should probably have not used names. I want all the emails to go to the same place. Just broken down and send in groups with the same name or owner.

I can't work out the difference ff between alerts and reports for the life of me in splunk 6. How do I do multiple searches in one report. For as far as I can see reports are the same as alerts.

As far as I can see splunk doesn't pass the info that well to script. Looks like I have to pass the location of the gz file to my script which I do some work with to get the CSV table out and work with that. Not the greatest.