Getting Data In

No Data reports- any way to not send email?

zindain24
Path Finder

Looking for a way to prevent Splunk from sending an email with a blank report. In our case certain reports run every hour and are often empty. My customers are asking for a way to stop these "No Data" emails. Anyone have a suggestion? Thanks!

Tags (1)
0 Karma
1 Solution

Takajian
Builder

I think you can configure alert condition to prevent Splunk from sending when search result is no data. The setting will be "Trigger if Number of results is more than 0 ". You can refer to following manual. Hope this help.

http://docs.splunk.com/Documentation/Splunk/latest/user/SchedulingSavedSearches

View solution in original post

0 Karma

Takajian
Builder

I think you can configure alert condition to prevent Splunk from sending when search result is no data. The setting will be "Trigger if Number of results is more than 0 ". You can refer to following manual. Hope this help.

http://docs.splunk.com/Documentation/Splunk/latest/user/SchedulingSavedSearches

0 Karma

rafaelschwed
New Member

Setting the trigger does not work, still sends the blank report.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...