How to not send email for splunk report if no results are found?

[anjana]

How to not send splunk report via email if no result are found .I cannot change it to alert and use number of results  >0 as I need to send it as a report with records . So I need to implement this as a report only not as alert.I have gone through the existing posts but could not find a solution ?

Is there any settings in advanced Edit which could help?

[PickleRick]

If you go straight to sendemail command, it will execute every time, it just might send empty set of results.

You could use the map command to execute a search (in this case - the sendemail one) for each result. Two caveats though:

1. map is considered a risky command so you need additional permissions to run it (and judging from the fact that you can't define an alert I assume you might not have those capabilities).

2. The subsearch is called for every result in your pipeline separately so if you want to just send the whole batch of your main search, you'd need to firts combine it into a single row, pass it to the map command and then "unpack" it again into multiple lines within the subsearch. A bit ugly.