Reporting

How to configure a scheduled report to not send an email if no results are found?

reswob4
Builder

I have a search for an event and that search is saved as a report and that report runs every hour. But since that event doesn't happen very often, most of the time I get an email that says:

The scheduled report 'REPORT' has run.

Report:  'REPORT'

View results in Spunk

No results found.

I don't particularly care if no results are found, I just want an email when the report contains results. How do I modify my report so that it doesn't send anything if no results are found?

Is there something on the Advanced Edit page that I can use?

Thanks.

I looked in the following posts, but they haven't been answered.

https://answers.splunk.com/answers/138956/how-can-i-configure-alerts-not-to-send-blank-empty-reports...
https://answers.splunk.com/answers/3343/how-to-not-send-out-empty-report-file-when-there-is-no-data-...
https://answers.splunk.com/answers/54762/no-data-reports-any-way-to-not-send-email.html
https://answers.splunk.com/answers/241836/why-is-my-scheduled-report-producing-emails-with-e.html

0 Karma
1 Solution

reswob4
Builder

Turns out the best way to do this is to make it an alert. Then the actions only happen if results are > 0 (or whatever you set there)

View solution in original post

reswob4
Builder

Turns out the best way to do this is to make it an alert. Then the actions only happen if results are > 0 (or whatever you set there)

woodcock
Esteemed Legend
0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...