alert action email with empty attachment

Monitoring Splunk

Hi all,

I'd like to create an alert that checks whether, as a triggered action of an alert, an email is being sent with an empty attachment.

It would be also nice to check whether the alert fails for any reason and the email is not being sent at all.

I've found the status of the saved search in scheduler.log, but I wasn't able to find anything regarding attachments.

Any idea?

Thanks!

Get Updates on the Splunk Community!

This puzzle series (first published here) is based on analysing words.Some of the statements in your puzzle ...

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Join the Conversation