I have a search for an event and that search is saved as a report and that report runs every hour. But since that event doesn't happen very often, most of the time I get an email that says:
The scheduled report 'REPORT' has run.
View results in Spunk
No results found.
I don't particularly care if no results are found, I just want an email when the report contains results. How do I modify my report so that it doesn't send anything if no results are found?
Is there something on the Advanced Edit page that I can use?
I looked in the following posts, but they haven't been answered.
You can use the approach described in this Q&A:
Turns out the best way to do this is to make it an alert. Then the actions only happen if results are > 0 (or whatever you set there)
View solution in original post