I have a search for an event and that search is saved as a report and that report runs every hour. But since that event doesn't happen very often, most of the time I get an email that says:
The scheduled report 'REPORT' has run.
Report: 'REPORT'
View results in Spunk
No results found.
I don't particularly care if no results are found, I just want an email when the report contains results. How do I modify my report so that it doesn't send anything if no results are found?
Is there something on the Advanced Edit page that I can use?
Thanks.
I looked in the following posts, but they haven't been answered.
https://answers.splunk.com/answers/138956/how-can-i-configure-alerts-not-to-send-blank-empty-reports...
https://answers.splunk.com/answers/3343/how-to-not-send-out-empty-report-file-when-there-is-no-data-...
https://answers.splunk.com/answers/54762/no-data-reports-any-way-to-not-send-email.html
https://answers.splunk.com/answers/241836/why-is-my-scheduled-report-producing-emails-with-e.html
Turns out the best way to do this is to make it an alert. Then the actions only happen if results are > 0 (or whatever you set there)
Turns out the best way to do this is to make it an alert. Then the actions only happen if results are > 0 (or whatever you set there)
You can use the approach described in this Q&A:
https://answers.splunk.com/answers/261163/is-there-a-way-i-can-schedule-a-saved-search-to-ru.html