Reporting

How can I send a schedule report without events?

laauespinosa
Explorer

Hi,

How can I send an empty schedule report (no events in the search)? 

I need to send a schedule report (daily) from an alert but sometimes there are no results. They need to see that csv report even is empty, but the visualization won't appear if there are no results.

Did you know how can I do that? Just the table visualization with empty results/values.

The fillnull don't work for this or am I using it wrong?

 

Thanks!

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @laauespinosa,

you could add another record at the end of your report.

e.g. if you report contains the count of events for host, add something liek this:

index=your_index
| stats count BY host
| append [ 
   | makeresults 
   | eval host="end of list", count="---"
   | fields host count ]

in this way you'll have a report every time is executed.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...