Is it possible to include the output of multiple searches into a single weekly report email?

[wellhung]

Hi,

Is this possible? Has anyone done this sort of reporting before?

Basically I want my report to contain the following (see list below), either inline or as attachment (no links to open Splunk).

Please note that the content should only report on events during the previous week. I plan on scheduling this report every Monday after midnight.

1) Events when CPU goes over 90% for 15+sec, also show top 5 processes during each event. From previous week only.

2) Filtered (errors) lines from tailing a log file. Log has time stamps. How do I make it show just the lines from previous week only?

3) Windows Event Logs (App, System, Security) that are Errors. From previous week only.

Is this possible? I guess the immediate question is, is it possible to append multiple search outputs (the entire text, no links) into the same email either as inline content or attachment.

Thanks!

[gcusello]

You should create a dashboard with all your searches and then schedule it as you prefer.
Problem are that form must be pdf and the result isn't so good as a dashboard because each panel is in a different page.
Bye.
Giuseppe

[gcusello]

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe

[splunkton]

Logically you can do that by appending.... but practically your report going to end up clumsy state mixing of all the events in a single report.

Difficult to understand...

[wellhung]

Thanks. Any way to point me to right query samples to do the task 1, 2, 3.

host="AQS-INTEGRATION" sourcetype="Perfmon:CPU Load" counter="% Processor Time" earliest="-7d@d"| bucket _time span=15s | stats avg(Value) as avg_CPU by _time | where avg_CPU >= 90 | SORT BY _time DESC

Does this query return the first part of 1)? I'm sort of on the fence with the bucket keyword.

Do you know how to start forwarding Process data? In wmi.conf there's a sample stanza called "LocalProcess" and I put Disabled to 0, but I don't see any new Source/type, I even created the index that that stanza is referring to ("perfmon").

Do you know why I am not getting Windows Event Logs? Inputs.conf I have them Disabled=0, I created an Index called wineventslog (because Splunk was complaining it was missing), and still i don't see any new source/sourcetypes that should belong to windows event logs.

For both parts I restarted both Splunk and the UFs.

Splunk seems to have automatically parsed the dates on my log files, that's good.

Going back can you give me a sample of multiple query searches in one result view? I want to see how difficult it is to understand.

Thanks!