How to separate daily quarantine email report to each user?

[jbanAtSplunk]

Hi,

There is a need to send automated summary of daily emails that are stopped by anti-spam filter.

In Splunk we have act=quarantined and we can see all stopped emails, but how to create "one alert or report" for specific users where they get on Email only results where their Email is matched. 

Example. If I do something like this

	index="email" act="QUARANTINED"
    | lookup email_notify_quarantine email AS orig_recipient OUTPUTNEW notify AS notify
    | where notify="true"
...

I'll get results for Quarantined messages for all user's that need to get that report and now If I create Scheduled Report or Alert I am afraid that user will get all list of Quarantined messages not only theirs.

[vigneshnarendra]

In the email alert action, choose trigger for each result under Trigger conditions.
and use the a variable in the email to list.

[scelikok · Accepted solution]

Hi @jbanAtSplunk,

You can look at Sendresults app. https://splunkbase.splunk.com/app/1794

[jbanAtSplunk]

Hi,

Alert for every event does not play in this case as I need to get one report with all Quarantined email for recipient.

SendResults is what we need and it's working, only challenge that we have is column order. It's reordering columns and I cannot get it ordered as I want even with Format Columns option

[Manasa_401]

Hello @scelikok 

By default the sendresults command sends the results as inline CSS in email body.

Is there a way to send the results as csv attachment?

Thanks,

Manasa