Reporting

Append triggering events to report summary

qas
Engager

I have a nightly report summarizing log events I am interested in. Is there a way to append the triggering log events after the timechart summary in the report?

Tags (1)
0 Karma

jrodman
Splunk Employee
Splunk Employee

The normal alert mechanisms will get the 'results' stream of a search, so the summarization will hide the events stream from the alerts.

The simplest approach would be to run it again, but differently, to get the events.

Probably its slow or you wouldn't be asking this.

The smart way would probably be to have a second search run using the prior search's artifacts. However, I don't know how to have two scheduled jobs communicate such a thing.

One interesting hackable feature is the 'custom condition search' which does run precisely this way. You could have for example a search which produces your events, then you hack the summarization into the 'alert condition' follow-on (warning, 10k default event limit), have that search emit at least one result, which will fire to cause the raw events from the original search to be sent.

A particularly evil method might be to use a custom alert script, and given the path to the results file, modify it to reach the events file, and grab those.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...