Hi everyone,
I'm kind of stuck here and need the help of people that have more knowledge than me :).
Currently I have build a (rather) advanced search of which the result is basicly a report of that passed some validation rules. To keep it simple the result of the search will tell the end-users which orders they need to reapply because of missing data. The plan is to schedule this report daily and send the list of incorrect orders to the correct people. However there are some requests in how this information should be visible.
For this I have been looking in to the reporting module, to give access to the report URL and provide the results. Main issue with this is that reports will always run and send an alert even when there are no results. I'm looking for a way to make it so that the email of the report is not being when there are no results. Is this in any way possible?
I know this can be achieved via an alert, which can also contain a link to the results of the alert. The main issue with this solution is that the search head becomes visible when redirecting to this link. Since people will be accessing the results that do not have a lot of Splunk knowledge themselves, I don't want them to have any insights in the search or be able to change anything in the results. Since this will just cause confusion.
Would this be possible to achieve via a custom python script? And if so, is there any standard available? Or are there "better" ways to do so?
