Dashboards & Visualizations

Personalized Daily Reports for Network Changes


I need to provide administrators with a daily report, providing a table of their network changes the previous day. I'm using the Change data model and the Network Changes dataset, and leveraging acceleration via tstats (some parts are removed for brevity).

Here's my search:

| tstats latest(time) AS time FROM datamodel=Change WHERE (nodename = All_Changes.Network_Changes) BY All_Changes.user, All_Changes.dvc, All_Changes.action, All_Changes.command, All_Changes.object_attrs, All_Changes.object_id
| `drop_dm_object_name(All_Changes)`
| lookup local=true s2_identities.csv identity AS user OUTPUT email
| table user email time dvc src action command object_attrs

The search looks for the latest event by User, Device, Source, Action, Command, and Attributes. Then it does a lookup for the user's Email. Here is a sample output:

alt text

My first thought was to create an alert, scheduled for once a day at 2:00 AM. The alert would search "Yesterday", trigger "For each result," and send an email to the token $result.Email$. This would work, but if a user made 10 changes, they'd get 10 emails at 2:00 AM. I'd like the user to get a single email with their 10 results, AND they wouldn't see results for another user. Is this possible?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!