How to schedule report with email with pdf attachment?

[will_paxata]

Somehow I have two scheduled reports that both send emails, and only one of them includes the PDF attachment while the other does not. Can someone enlighten me on why one report includes the PDF attachment and the other does not?

This report INCLUDES the pdf attachment:
coreMsUsed | search NOT coreMsUsed=-1 | lookup "all-tenants" tenantId as tenantId OUTPUT tenantName as "Tenant Name"| stats sum(coreMsUsed) by "Tenant Name"

This report DOES NOT include an pdf attachment:
| inputlookup "all-tenants" | lookup weekly_active_tenants.csv tenantId as tenantId | where isnull(loggedin) | fields tenantName

Is there anything about the second query that turns off email attachments? Are there configs that I am missing? fyi, I am using Splunk Cloud.

Thanks in advance!

[krish3]

Just edit the report and choose edit schedule and make sure attach as PDF is checked for your second query.

Click here for Screen Shot

[will_paxata]

Thanks krish3. That view in your screenshot is reachable from the splunk search UI but not from the listview of all reports. DIFFERENT UI!

[ChrisG · Accepted solution]

Did you schedule your report and configure it to send a PDF attachment? See Schedule reports in the Reporting Manual.