Splunk report on demand

[SS1]

Hi,

I have a report which is scheduled to run every day at 8 AM. 

Is it possible to generate that report to email address X by executing a command via CLI ?

[SS1]

Just wanted to see if i can issue a command via CLI at 8:15 AM and generate that report ?

[venkatasri]

Hi @SS1 

can be achieved if you have _audit index access to query it using Splunk Rest API and having mail functionality enabled.

#Step1 - Find the search_id of savedsearch
index=_audit savedsearch_name=<your_search_name> earliest=-20m latest=now | field search_id |  
Rest API POST method -https://docs.splunk.com/Documentation/Splunk/8.2.0/RESTREF/RESTsearch#search.2Fjobs

#Step2 get the results of step1 to retrieve search_id
Rest API GET method -https://docs.splunk.com/Documentation/Splunk/8.2.0/RESTREF/RESTsearch#search.2Fjobs

#Step3 retrieve the search job results of savedsearch
REST API GET Method -
https://docs.splunk.com/Documentation/Splunk/8.2.0/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7D.2Fresults
-> output the results to a file

#Step4 use the linux sendmail command to send results to your required email, assuming you have SMTP enabled in linux

 -----

An upvote would be appreciated and accept solution if it helps!

[venkatasri]

Hi @SS1 

Reports functionality having trigger action Email is one of the action if you want to enable then at 08 AM you will get Email. In UI go to Edit -> schedule -> trigger Actions -> Email and fill in details required and check the additional options like send pdf, results etc.

Just wondering why you want to push it from CLI is this for ad-hoc basis rather than every days 08 AM?

Backed savedsearches.conf looks like this,

## cron is indicaive
[your_saved_search_report_name]
action.email = 1
action.email.sendpdf = 1
action.email.sendresults = 1
action.email.to = youremails@domain.com
alert.track = 0
cron_schedule = 0 6 * * 1
enableSched = 1

---

An upvote would be appreciated if it helps!