How to create a cron-scheduled alert that triggers a mail with the notable event, urgency and triggered time?

[paul96]

I was trying to create a cron-scheduled alert in Splunk, that would trigger a mail with the notable event, urgency and trigger time.
I tried it by using |es_notable_events, but it returns a large amount of data.

Is there any other solution?

[jawaharas]

Try below suggestions:

1. Increase the frequency of alert - say every 30 minutes or even lesser. So, that number events for that time period will be less.
2. Or Configure the alert mail to send the email with 'Attach CSV' option instead of populating search results in email body.

[jawaharas]

@paul96
Can you accept the answer if it's helped you? Thanks.