I need to provide administrators with a daily report, providing a table of their network changes the previous day. I'm using the Change data model and the Network Changes dataset, and leveraging acceleration via tstats (some parts are removed for brevity).
Here's my search:
| tstats latest(time) AS time FROM datamodel=Change WHERE (nodename = All_Changes.Network_Changes) BY All_Changes.user, All_Changes.dvc, All_Changes.action, All_Changes.command, All_Changes.object_attrs, All_Changes.object_id
| `drop_dm_object_name(All_Changes)`
| lookup local=true s2_identities.csv identity AS user OUTPUT email
| table user email time dvc src action command object_attrs
The search looks for the latest event by User, Device, Source, Action, Command, and Attributes. Then it does a lookup for the user's Email. Here is a sample output:
My first thought was to create an alert, scheduled for once a day at 2:00 AM. The alert would search "Yesterday", trigger "For each result," and send an email to the token $result.Email$. This would work, but if a user made 10 changes, they'd get 10 emails at 2:00 AM. I'd like the user to get a single email with their 10 results, AND they wouldn't see results for another user. Is this possible?
