How do I create a report that can run automatically only when the indexer performs indexing after receiving an input file from forwarder instead of the scheduling with given fixed time ?
I have a requirement to create a report to consider the actual volumes which acquires data from an indexed file that is received forwarded by the forwarder (not frequently) but when received and indexed the input file the report should automatically run with out depending on the scheduler. May be for example if the file has to be generally received daily once but if the file has not arrived but it arrived in delay (no fixed delay) or arrived next day how can i manage this kind of requirement in splunk ?
create an alert that check if there are data in a period (e.g. one hour): if there are data, alert sends a report with the found data to an eMail, if there aren't results, alert isn't triggered and it not doesn't send anything.