Reporting

What is the best way to create automated reports from multiple search outputs?

smcdonald20
Path Finder

I use the CSV exports of 10-12 search results each month to create an Excel report.

I am manually exporting the results, then saving them in a location on my PC, then running an Excel macro that pulls all of the exports into one file and formats the data.

My question: What is the best way to automate exporting these files to the location?
Is outputcsv the best way, or should I "run a script" to export to my location?

0 Karma
1 Solution

niketn
Legend

There are three options you have:

1) Create a Scheduled Report with Send Email action. Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/6.5.0/Report/Schedulereports

2) Create a scheduled monthly Alert with Send Email as alert action and attach report generate by Search result as csv or pdf as per your need. Refer to following documentation: http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Setupalertactions

3) You save Search result as a Table in Dashboard and schedule email as PDF.

In either of the above three cases you have to ensure that Email exchange is properly setup on Splunk Server. There is an option to send test email with PDF delivery as option, in order to check the same. Most of email alert setup configuration have been called out in the following documentation:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Emailnotification

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

There are three options you have:

1) Create a Scheduled Report with Send Email action. Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/6.5.0/Report/Schedulereports

2) Create a scheduled monthly Alert with Send Email as alert action and attach report generate by Search result as csv or pdf as per your need. Refer to following documentation: http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Setupalertactions

3) You save Search result as a Table in Dashboard and schedule email as PDF.

In either of the above three cases you have to ensure that Email exchange is properly setup on Splunk Server. There is an option to send test email with PDF delivery as option, in order to check the same. Most of email alert setup configuration have been called out in the following documentation:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Emailnotification

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

smcdonald20
Path Finder

Thank you, but what I am looking for is a way to automate sending these files to a location on a file server.
Just scheduling to email will still mean manually going and saving all the attachments in the location myself.

Any ideas on the best way to have all of these reports exported and saved to a specific location each month?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Why not create a dashboard that contains all of the reports? You could then schedule it for regular delivery as a PDF.

---
If this reply helps you, Karma would be appreciated.
0 Karma

smcdonald20
Path Finder

Thanks Rich, but the export has to be in excel format.
Any other ideas?

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...