Monitoring Splunk

Can Splunk send a file as attachment without reading the content or data in the file ?

vchennuri
Engager

Can Splunk send a file as attachment without reading the content or data in the file

0 Karma

vchennuri
Engager

A file is generated every day having data of 10 to 20 lines in a location with the difference in file name. Can splunk read the data in generated file and send the file as an email alert whenever that new file is generated ?

0 Karma

solarboyz1
Builder

Sort of...

You would monitor the location the files are produced:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Monitorfilesanddirectorieswithinputs.conf

You would create a search looking for new events from the input you just created.

Assuming your inputs, timestamps, and timezones are set correctly, any new events would indicate a new file.

In which case, you would schedule a search every X minutes, configure the email to generate a single email, and attach the search results.

0 Karma

solarboyz1
Builder

I dont know of any way for Splunk to attach a non-search produced file to an email using the standard "Send Email" alert action.

This can be accomplished by creating an alert action, which could send an email and attach a document:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Alert/Configuringscriptedalerts

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Send it where? What is your use case?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...