Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- Why is my scheduled report only returning one row...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a very simple search saved as a Scheduled E-mail Report. When I manually run the search it works as expected. The scheduled e-mail report only contains the first entry or I've also received separate e-mails each containing a row from the report.
The search string ends with | top limit=20 field_name_here Is there something I don't realize about the top command that would affect scheduled reports?
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I suspect the Alert mode parameter in Alert definition, it could be: Once per search or Once per result.
Set it to Once per search and check the behavior, you can do from Web interface or from savedsearches.conf:
alert.digest_mode = True
Regards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I suspect the Alert mode parameter in Alert definition, it could be: Once per search or Once per result.
Set it to Once per search and check the behavior, you can do from Web interface or from savedsearches.conf:
alert.digest_mode = True
Regards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do I check the Alert definition for a Report via the web interface (6.5.2) ? I can't seem to find anything about "Alert" for this Report....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Settings -> Searches, reports, and alerts -> Click the alert under Search name column -> Alert mode
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is your Alert mode set as Once per result?
Can you share the search and other alert options you set in report?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try just |top 20 field_name_here
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This did not help unfortunately. Same behavior.
Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA
.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...
A Season of Skills: New Splunk Courses to Light Up Your Learning Journey
