How to create one report to generate multiple emails based on results?

[bamartinez]

I have a single report that features a list of devices broken up by the group that supports them. I want to have that single report run on a monthly basis - when it runs it should do the following:

1. Report runs
2. Device list is generated, so one column is Computer_Name, another column is Support_Team
3. Upon generation, emails kick off to email@domain.com
4. I need the body to be dependent on the Support_Team field
   1. i.e. all devices under Support_Team = Alpha should reference only Alpha's devices (email 1)
   2. All devices under Support_team = Bravo should reference only Bravo's devices (email 2)

Is this possible? Or is this a pipe-dream? Today I handle this by having 10 separate reports, 1 per Support_Team field.

[ITWhisperer · Accepted solution]

If you set it up as an alert, you can trigger for each result, so you would have to arrange your search so that each result was for a different user and contained all the information for that user.

[bamartinez]

That worked in that I was able to kick off 12 emails - 1 per Support_Team. 

However, the formatting of the CSV thats output is not legible.. its putting all of the data on one line.

[ITWhisperer]

Yes, you can't have your cake and eat it, as the saying goes!

[bamartinez]

I ended up having 1 alert that triggers on a cron schedule - and when it triggers it kicks off 1 email per result.

That email has a tokenized variable which I then have used to direct WHERE the email goes, and also is used in generating a custom URL so from the email, someone can click that URL and be brought to a Splunk Dashboard containing the necessary data for said recipients.