Configure Scheduled Search to send out csv file in email instead of inline results

[anantshah]

Hello,

I have a scheduled search which sends out alerts when certain criteria matches. Currently the results are sent inline in the email. Is there a way to send the results in csv format as a attachment? We have several searches and i do not want to make the change global.

Splunk Version 4.1.6

[Simeon · Accepted solution]

You should be able to do this by editing the alert_actions.conf file in $SPLUNK_HOME/etc/system/local. Specifically, create/add the email stanza to specify csv non-inline results to be included.:

[email]
format = csv
sendresults = 1
inline = 0

For reference, see the alert_actions.conf.spec file.

[mohitvohra109 · Accepted solution]

There's another way that I'm using these days: Use the sendemail command to send the files as csv and add it to a search; then schedule the search to run at specific time. For example:

"search pattern1" | ..... | table col1,col2... | sendemail to= format=html subject="Your subject" server=testgateway.sample.com sendresults=true inline=false graceful=true

Two things used here: the table command to tabularize the search results, and the sendemail command.

You can replace the above sample values with your own values. The key options used in this command are: 'inline=false' and 'graceful=true'.

If we choose 'inline=false', it automatically will append the results in .csv format (the file will be named splunk-results.csv so you can save it as per your need.

'graceful=true' this means that Splunk will exit gracefully in case it faces any issue while trying to send the mail.

For more info on table and sendemail, refer to Splunk help section; it has great examples which you can use.

Hope that helps.

Regards,

Mohit Vohra

[anantshah]

Can i configure it to send email only if there are results?

[anantshah]

Worked like a charm. Thanks!!

[Simeon · Accepted solution]

You should be able to do this by editing the alert_actions.conf file in $SPLUNK_HOME/etc/system/local. Specifically, create/add the email stanza to specify csv non-inline results to be included.:

[email]
format = csv
sendresults = 1
inline = 0

For reference, see the alert_actions.conf.spec file.

[Simeon]

This will apply to all emails. Currently, there is no capability to set this for specific alerts.

I highly recommend you create a support case that requests we create this functionality as an enhancement request. I cannot guarantee it will get added to the product, but I do believe this would be useful functionality and it's great that you bring this up as a customer.

[anantshah]

Will this affect all scheduled alerts? I only want to modify a specific scheduled alert.

Thanks.