Reporting

Using Splunk to send custom emails to a large number of users

rturk
Builder

Hi Splunkers!

Has anyone had any experience using Splunk to send a large number (1000+) of emails. The scenario I'm thinking of is say to send data usage reports (generated by Splunk) to a large number of users, where they are given a report showing their total usage for the period, and a link to log into Splunk to get the finer details.

Just putting this out there to see what anyone else might have done.

Cheers!

RT

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could consider doing something roughly like this:

base search computing usage reports, one row per user | map maxsearches=1000 search="stats count | eval field1 = \"$field1$\" | eval field2 = \"$field2$\" | ... | sendemail subject=\"$subject$\" to=\"$to$\" ... "

Your base search would have to produce subject lines, receiver mail addresses, the whole nine yard. The mapped search would create a single dummy event using stats, copy over fields you want to include, and send out the email.

I'm not quite sure if this is feasible for 1000+ emails though... but probably more feasible than maintaning 1000+ individual alerts.

0 Karma

linu1988
Champion

Hello,
It is possible. I suppose it's 1000 users at once rather sending one by one. And if you are going to send them at once they how are you planning to hide the details from user to user. And there is no issue with privacy you could go for s distribution list with all the users in it. How will you manage them if you put them in a conf file! So the information in the question is very less what exactly the email is and how is it going to be sent with which data? Let us know if you still need any help

Thanks

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...