Reporting

What is the best way to create automated reports from multiple search outputs?

smcdonald20
Path Finder

I use the CSV exports of 10-12 search results each month to create an Excel report.

I am manually exporting the results, then saving them in a location on my PC, then running an Excel macro that pulls all of the exports into one file and formats the data.

My question: What is the best way to automate exporting these files to the location?
Is outputcsv the best way, or should I "run a script" to export to my location?

0 Karma
1 Solution

niketn
Legend

There are three options you have:

1) Create a Scheduled Report with Send Email action. Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/6.5.0/Report/Schedulereports

2) Create a scheduled monthly Alert with Send Email as alert action and attach report generate by Search result as csv or pdf as per your need. Refer to following documentation: http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Setupalertactions

3) You save Search result as a Table in Dashboard and schedule email as PDF.

In either of the above three cases you have to ensure that Email exchange is properly setup on Splunk Server. There is an option to send test email with PDF delivery as option, in order to check the same. Most of email alert setup configuration have been called out in the following documentation:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Emailnotification

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

There are three options you have:

1) Create a Scheduled Report with Send Email action. Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/6.5.0/Report/Schedulereports

2) Create a scheduled monthly Alert with Send Email as alert action and attach report generate by Search result as csv or pdf as per your need. Refer to following documentation: http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Setupalertactions

3) You save Search result as a Table in Dashboard and schedule email as PDF.

In either of the above three cases you have to ensure that Email exchange is properly setup on Splunk Server. There is an option to send test email with PDF delivery as option, in order to check the same. Most of email alert setup configuration have been called out in the following documentation:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Emailnotification

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

smcdonald20
Path Finder

Thank you, but what I am looking for is a way to automate sending these files to a location on a file server.
Just scheduling to email will still mean manually going and saving all the attachments in the location myself.

Any ideas on the best way to have all of these reports exported and saved to a specific location each month?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Why not create a dashboard that contains all of the reports? You could then schedule it for regular delivery as a PDF.

---
If this reply helps you, Karma would be appreciated.
0 Karma

smcdonald20
Path Finder

Thanks Rich, but the export has to be in excel format.
Any other ideas?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...